In this video, we are going to see what is file inclusion and we are going to solve the low difficulty
file inclusion challenge on dam vulnerable web application.
File inclusion.
Vulnerability is a type of vulnerability that allows an attacker to include a file, usually through
a script on a web server that is not properly checked for validity.
This can also allow an attacker to execute arbitrary code, including PHP code on the server, potentially
leading to server compromise.
Now there are two main types of file inclusion vulnerabilities.
The first is local file inclusion that allows an attacker to include files that are stored locally on
the server.
Then remote file inclusion, which allows an attacker to include files from a remote server such as
through a URL.
You should be on Linux or Parrot OS in VMware VirtualBox or running natively on your PC.
Go to settings and set the difficulty to low.
Click on the first file, we can see that file name is included in the URL.
Now we can provide any file name that is on the system to open it.
For example, we can check the passed file as under and open the password file on the system that contains
the user details.
Now let's see the actual demonstration.
First of all, set the security level of too low.
Go to file inclusion tab.
And you can see that if we click any file on the server, it will execute on the server and we can also
see the file name in the URL.
If we replace the file name with the complete path of password file, we can get the details of users.
And you can see that all details of users have been displayed.
Which means the site is vulnerable to local file injection attack.