Local file, inclusion vulnerabilities, these exploits or vulnerabilities allow you to read any file
that is within the same server.
So even if the file exists outside the VA, w w w you'll be able to read it and read info with it.
Now, why this vulnerability is critical because you can read any files.
So if the users are storing some sort of important files or passwords files, then you'll be able to
read them and then from there you can further exploit your target.
Also, if there is a number of websites on the same server and you managed to find this on a website
that you're not targeting, then you might be able to access files related to that, to the website
that you're targeting and then further exploit your website from there.
So let's have a look on this.
And we'll also the way we're going to be exploiting this vulnerability is through the URL.
So usually in our code execution example, we were writing the code in here now.
Sometimes you might find the code one vulnerability in the URL, so it will be something like ACMD and
then you put the command or for example, in this case it would be i.p equals to the IP, for example,
10, 20, 14, two or three.
And then you do you put the sign and then you put your credibility after it, for example.
So because our example was just in the textbooks.
Sam is going to happen here and our final conclusion, vulnerability, so we can see that when you're
in here and this your URL, it's saying that this.
File is going to take a page and it's loading something called includes WHV, so it looks like it's
actually loading another page like this current page is loading another page called Included.
So, again, you'd be browsing the Web server and trying to get a feel of it.
And you see something like this or you see something called IP equals the IP and then you know that
there is a ping, for example, for the previous video.
So for this that we know that our target's trying to open a file and the files called include that BHP.
Let's see if there is actually a file called include that, so I'm just going to remove everything here.
And try to access including me directly, and as we can see, we actually do have a file called include
that it's not running properly, but it exists and it's in the same working directory, so.
Let's try and see if we can read a file that is stored in the computer and we're going to use a file
called ATC Password, so that's the file which contains all the users and their path is on the current
Web server.
So let's have a look on this.
So BTC.
This file contains all the users for the current operating system, so if I just go on my card right
here and if I run it here, if I just do cut.
If you see a password, you'll see all the users that I have on the current computer.
And.
Their default path on the current operating system, so we're going to try to read this file.
And to do that, let's go back and see our current location to our current location is in the FBI file
and the FBI directory, so we need to go back.
One, two, three, four, five times, and then go to ETSI password, so going back would be done using
the dot dot.
And let's try and do that, so at the moment, we're accessing this current file and just to make it
easier for you, actually, let's just put the full part right here.
So on the page, it's trying to access this page.
So what we need, we actually want a place called ETEK Password, so we need to go back five times for
these directories.
So this one is going to be to start them from here.
So we're going.
Like.
Bug.
I.
Back.
And back and then we're going to go to ETSI.
Password.
And as you can see now, we have the output of the passport file.
We can copy that and start here, and then you'll be able to read it and just get more information about
the websites that you're targeting right now.
Again, you can use this to try to access different files, sensitive files or files of other websites
on the same server.
Now, let's go to the security settings and I'm going to set this to medium because I just want to show
you that the medium setting is and this is actually can be exploited exactly the same way as the low
level.
So the security settings medium, I'm going to go back to full inclusion and we're going to use the
exploit the exact same way that we did it before.
And as you can see, we managed to get the contents of ATC password.