File Inclusion Exploitation

File inclusion exploitation covers two distinct attack paths. Local File Inclusion reads files from the server filesystem and can escalate to code execution through log poisoning, PHP wrappers, and session injection. Remote File Inclusion loads and executes attacker-hosted code directly when allow_url_include is enabled.

Confirm the vulnerability first through file inclusion vulnerability detection before using the pages in this section.

Pages in This Section

Local File Inclusion Exploitation covers path traversal, PHP filter wrappers for source disclosure, high-value file targets on Linux and Windows, and filter bypasses for encoded and truncated paths.

LFI to Remote Code Execution covers escalating a confirmed LFI to code execution via log poisoning, session injection, PHP stream wrappers, and /proc/self methods.

Remote File Inclusion Exploitation covers confirming RFI, hosting and delivering PHP web shells, getting a reverse shell, and bypassing RFI filters.

Command Injection Bypasses covers space, slash, and keyword filter bypasses using IFS, base64, hex, and environment variable tricks for both Linux and Windows targets.

File Upload Exploitation covers delivering a web shell after bypass confirmation, locating the upload path, triggering execution, and getting a reverse shell from PHP and ASPX targets.