Exploiting Local File Inclusion to Gain Shell Access
This exploit is aimed at exploiting local file inclusions. The ability to exploit this occurs when a web application uses a path to a file “has to be included as an input without treating it as untrusted input. This would allow a local file to be supplied to the include statement” ( https://www.acunetix.com/blog/articles/local-file-inclusion-lfi/ ). Before running through this exploit, let’s first define what local file inclusion (LFI) is. According to Ian Muscat, LFI “refers to an inclusion attack through which an attacker can trick the web application in including files on the web server by exploiting functionality that dynamically includes local files or scripts. The consequence of a successful LFI attack includes Directory Traversal and Information Disclosure as well as Remote Code Execution” (Muscat, 2017). With this working definition, let's get started running through how I conducted this exploitation. As always, I used Kali Linux as my attacker machine ( https://www....