LFI 101

• back-end languages liek PHP, JS, Java use HTTP parameters to specify what resource is shown on the webpage.
• these can be manipulated to show the content on local files on the hosting server if not securely coded.
  • This is LFI
• 

---

Vulnerable code

• 

PHP

• 

NodeJS

• 

Java

• 

.NET

• 

Some of the above functionalities only read content, while some might allow to write.

Function	Read Content	Execute	Remote URL
PHP
include()/include_once()	✅	✅	✅
require()/require_once()	✅	✅	❌
file_get_contents()	✅	❌	✅
fopen()/file()	✅	❌	❌
NodeJS
fs.readFile()	✅	❌	❌
fs.sendFile()	✅	❌	❌
res.render()	✅	✅	❌
Java
include	✅	❌	❌
import	✅	✅	✅
.NET
@Html.Partial()	✅	❌	❌
@Html.RemotePartial()	✅	❌	✅
Response.WriteFile()	✅	❌	❌
include	✅	✅	✅