File inclusions are a piece of each propelled server-side scripting language on the web. They are expected to keep web applications’ code clean and viable. They additionally permit web applications to read documents from the file system, provide download functionality, parse configuration documents, and do other comparative tasks. Although, if not implemented correctly, they can turn into exploitable web vulnerability, which malicious aggressors can exploit.

Local File Inclusion (also known as LFI) is the process of including files, that are already locally present on the server, through the exploiting of vulnerable inclusion procedures implemented in the application.

This vulnerability occurs when this input is not properly sanitized, allowing directory traversal characters (such as dot-dot-slash) to be injected. Although most examples point to vulnerable PHP scripts, we should keep in mind that it is also common in other technologies such as JSP, ASP, and others.

To experiment with the file inclusion attack, click on the “File Inclusion” tab on the DVWA web page. Take a closer look at the last part of the URL “…/?page=include.php,” the website tries to load a page called “include.php.”