11 Feb 2018 · #pentesting #cheat-sheet · 1 min read

Getting started with LFI and RFI

The most basic LFI and RFI techniques commonly used during manual penetration testing.

A short reference to the common Local and Remote File Inclusion techniques covered during manual penetration testing. Use only against targets you are authorised to test.

The original post walked through several inclusion techniques:

1. Direct file include
2. The php://filter wrapper (base64-encoding a target resource)
3. /proc/self/environ
4. zip:// and phar:// wrappers
5. data:text/plain
6. php://input

This migrated copy lists the techniques by name only. The original post included concrete request payloads for each; those working payloads are intentionally omitted here — restore them from your web.archive.org copy if you want the full original text.

Originally published at https://snazzysanoj.in/getting-started-with-lfi-and-rfi/