Inclusion flaws live in dynamic include/require style sinks, where a request parameter decides which file the interpreter loads and runs.
Classic PHP code like include($_GET['page'] . '.php') hands the attacker control over the loaded path. Two directions follow. Local inclusion points the sink at files already on the server: traversal to read source and secrets, wrappers to disclose or decode, and poisoning tricks (logs, /proc, session files, prior uploads) that convert a read primitive into code execution. Remote inclusion points the sink at an attacker-hosted URL so the interpreter fetches and runs external code directly, subject to the engine's URL-include settings. The two pages cover the payloads and the chains that promote a mere file read to full execution.
Pages#
- Local: LFI through traversal and PHP wrappers for source disclosure, plus log, environ, session, and upload poisoning chains that escalate a file read into code exe...
- Remote: RFI points an include sink at an attacker-controlled URL so the interpreter fetches and executes external code, gated by allow_url_include and allow_url_fopen.
Tools#
- LFISuite: automated LFI detection and exploitation.
- kadimus: LFI and RFI scanning and exploitation.
- fimap: automated local and remote file-inclusion testing.
- Burp Suite: Repeater for traversal, wrapper, and URL-include payloads.