Training Overview
The "File Inclusion (LFI/RFI)" training aims to teach how to identify local and remote file inclusion vulnerabilities in web applications and how to protect against these vulnerabilities. This comprehensive training will cover the fundamental principles of LFI (Local File Inclusion) and RFI (Remote File Inclusion) vulnerabilities and various attack techniques in detail.
In the training content, we will demonstrate how LFI and RFI vulnerabilities work and how such attacks are carried out through practical examples. We will focus on detecting LFI vulnerabilities and techniques for exploiting these vulnerabilities. Additionally, we will examine how RFI attacks are conducted.
What you will learn
- The difference between Local File Inclusion (LFI) and Remote File Inclusion (RFI).
- How to exploit file inclusion vulnerabilities to read sensitive system files.
- Techniques to bypass common filters and protection mechanisms.
- How to escalate a file inclusion vulnerability to achieve remote code execution.
Tools you will use
- Burp Suite
- A web browser
- Various file inclusion payload lists
Prerequisites
- A solid understanding of web application functionality.
- Familiarity with Linux or Windows file system structures.
- Basic knowledge of a web proxy like Burp Suite.
Who this is for
- Web Penetration Testers.
- Security Researchers and Bug Bounty Hunters.
- Web Developers aiming to prevent critical security flaws.
Training sections
- 1Introduction
- 2Local File Inclusion (LFI)
- 3Bypass Techniques
- 4Remote File Inclusion (RFI)
- 5Application
- 6Prevention Methods
- 7Exam
Continue learning
Practice the topic in a lab or continue with a related Hackviser guide.