🌎 Remote File Inclusion

What it is

Anywhere a filename or a path reaches the filesystem, the question is whether you can steer it. Include a local file, include a remote one, or upload something the server is willing to execute - all three come from the same trust mistake.

How I attack it

1. Find the parameter that names a file, then walk upwards and see where the app stops you.
2. If a prefix or suffix is added, work with it: known directories, null bytes on old stacks, encoding tricks against a weak filter.
3. For uploads, separate the three checks - extension, content type and content - and defeat them one at a time.
4. Know what you want to read before you start: configs, credentials, source, and on Linux /proc for the quick wins.

Learn it from The XSS Rat

Free reference reading