Looking for file inclusions
File inclusion vulnerabilities occur when developers use request parameters, which can be modified by users, to dynamically choose which pages to load or to include in the code the server will execute. Such vulnerabilities may cause a full system compromise if the server executes the included file.
In this recipe, we will test a web application to discover whether it is vulnerable to file inclusions.
How to do it...
We will use Damn Vulnerable Web Application (DVWA) for this recipe, so we need both the Kali and vulnerable virtual machines. Let's take a look at the following steps:
- Log into DVWA and go to
File Inclusion. - It says that we should edit the
GETparameterpageto test the inclusion, so let's try withindex.php. The result is shown in the following screenshot:
It seems that there is no index.php file in that directory (or it is empty). Maybe this means that Local File Inclusion (LFI) is possible.
- To try LFI, we need to know the name of a file that really exists...
