> For the complete documentation index, see [llms.txt](https://dev-angelist.gitbook.io/ewptv2-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://dev-angelist.gitbook.io/ewptv2-notes/readme/system-security-3/7.3-file-inclusion-lfi-and-rfi.md).

# 7.3 File Inclusion (LFI and RFI)

https\://www\.indusface.com/learning/file-inclusion-attacks-lfi-rfi/

## File Inclusion (LFI and RFI)

Local file inclusion (LFI) and remote file inclusion (RFI) are vulnerabilities that allow attackers to include files on a web server. Both can lead to malware being uploaded to the server. 

|                    | Local file inclusion (LFI)                      | Remote file inclusion (RFI)              |
| ------------------ | ----------------------------------------------- | ---------------------------------------- |
| How it happens     | Exploits local file upload functions            | Exploits vulnerable inclusion procedures |
| What it includes   | Files that are already on the server            | Files from remote sources                |
| How it's exploited | Malicious characters are uploaded to the server | External URLs are injected into the page |

To prevent these vulnerabilities, you can: 

* Use secure coding techniques
* Sanitize user-supplied input
* Don't rely on blacklisting, encoding, or filtering

You can test for file inclusion vulnerabilities using: 

* The PHP Filter, which can prevent the server from executing a file
* Testing for directory traversal characters, such as ../

These vulnerabilities are often found in PHP applications. They can lead to: Outputting the contents of a file, Arbitrary code execution, and Uploading malware to the server. 

### **File Inclusion vs. Directory Path Traversal**

**Directory Path Traversal** is a vulnerability that occurs when an attacker can manipulate the file path used by an application to access files.

This manipulation allows attackers to traverse directories and access files or directories outside the intended scope. The vulnerability arises when an application doesn’t properly validate or sanitize user input when constructing file paths.

Directory Path Traversal can often be a means to exploit File Inclusion vulnerabilities. If an attacker can manipulate the file path, they can use it to achieve LFI (Local File Inclusion).

While Directory Path Traversal primarily focuses on manipulating the file system path, File Inclusion vulnerabilities deal with including external files (either locally or remotely).

### Other Resources

* [LFI and RFI](https://www.indusface.com/learning/file-inclusion-attacks-lfi-rfi/)