Local file inclusion vulnerabilities.
These exploits or vulnerabilities allow you to read any file that is within the same server so even
if the file exists outside the var w w w you'll be able to read it and read info with it.
Now why this vulnerability is critical because you can read any files.
So if the users are storing some sort of important files or password files then you'll be able to read
them and then from there you can further exploit your target.
Also if there is a number of Web sites on the same server and you manage to find this on a website that
you're not targeting then you might be able to access files related to the to the website that you're
targeting and then further exploit your Web site from there.
So let's have a look on this and we'll also the way we're going to be exploiting this burning ability
is through the URL so usually in our code execution example we were writing the code in here.
Now sometimes you might find the code word vulnerability in the URL so it'll be something like CND and
then you put the command or for example in this case it would be IP equals to the IP.
For example 10 20 14 2 0 3 and then you do you put the sign and then you put your P.W. the after it
for example.
So because our example was just in the text box same is gonna happen here and our file inclusion vulnerability.
So we can see that when you're in here and this your url.
It's saying that this file is gonna take a page and it's loading something called include BHP so it
looks like it's actually loading another page like this current page is loading another page called
include BHP.
So again you'd be browsing the web server and trying to get a feel of it and you see something like
this or you see something called IP equals the IP and then you know that there is a ping for example
for the previous video.
So for this that we know that our targets trying to open a file and the farthest called include the
BHP let's see if there is actually a file called include that BHP.
So I'm just gonna remove everything here
and try to access include the BHP directly and as we can see we actually do have a file called include
that BHP.
It's not running properly but it exists and it's in the same working directory.
So let's try and see if we can read a file that is stored in the computer and we're going to use a file
called ATC password.
So that's the file which contains all the users and their path is on the current web server so let's
have a look on this so ATC this file contains all the users for the current operating system.
So if I just go on my county right here and if I run it here if I just do cut it you see password you'll
see all the users that I have on the current computer and their default path on the current operating
system.
So we're going to try to read this file and to do that.
Let's go back and see our current location.
So our current location is in the FBI file in the FBI directory.
So we need to go back one two three four five times and then go to ATC password.
So going back would be done using the dot dot and let's try and do that.
So at the moment where access in this current file and just to make it easier for you actually let's
just put the full path right here
so on the page it's trying to access this page.
So all we need we actually want a place called ATC password.
So we need to go back five times for these directories.
So this one is gonna be a start them from here.
So we're going
back back back.
And back and then we're going to go to EDC password and as you can see now we have the output of the
ATC password file.
We can copy that and stored here and then you'll be able to read it and just get more information about
the websites that you're targeting right now again.
You can use this to try to access different files sensitive files or files of other Web sites on the
same server.