One of the most common web application vulnerabilities is LFI, which allows unauthorized access to sensitive files on the server. Such a common weakness is often safeguarded against, and low-hanging fruit can be defended quite easily. But there are always creative ways to get around these defenses, and we'll be looking at two methods to beat the system and successfully pull off LFI.
LFI (local file inclusion) is a technique that allows an attacker to access files on the system that they otherwise wouldn't be able to view. It's usually done via a vulnerable web app, where files outside of the web document root are accessed using various methods.
In all but the most poorly written web apps, LFI usually isn't as easy as merely requesting the desired file. But there are techniques to get around these restrictions, such as using the PHP filter method and the /proc/self/environ method. To test these out, we'll be using DVWA (Damn Vulnerable Web Application) as the target and Kali Linux as the attacking machine.
Method 1: PHP Filter Wrapper
To start, log into DVWA with the default credentials, which are admin and password.
Next, go to the "DVWA Security" page. Set the security level to "low" from the drop-down and hit "Submit."
Finally, navigate to the "File Inclusion" page, which is vulnerable to LFI.
The most basic type of LFI is the restrictions advanced techniques
