Hackervice
CtrlK
LinkedInGitHub
  • 🤓Welcome to HackerVice
  • 🧪CTF / Labs
    • HTB Certified Bug Bounty Hunter
      • Information Gathering
        • WHOIS
        • DNS
        • Active Infrastructure Identification
        • Active Subdomain Enumeration
        • Virtual Hosts
        • Information Gathering - Web - Skills Assessment
      • Attacking Web Applications with Ffuf
        • Directory Fuzzing
        • Page Fuzzing
        • Recursive Fuzzing
        • Subdomain Fuzzing
        • Filtering Results
        • Parameter Fuzzing
        • Value Fuzzing
        • Skills Assessment - Web Fuzzing
      • JavaScript Deobfuscation
        • Source Code
        • Deobfuscation
        • HTTP Requests
        • Decoding
        • Skills Assessment
      • Cross-Site Scripting (XSS)
        • Stored XSS
        • Reflected XSS
        • DOM XSS
        • XSS Discovery
        • Phishing
        • Session Hijacking
        • Skills Assessment
      • SQL Fundamentals
        • Reading Files
        • Writing files
        • Skills Assessment
      • SQLMap Essentials
      • Command Injections
        • Detection
        • Injection Commands
        • Other Injection Operators
        • Identifying Filters
        • Bypassing Space Filters
        • Bypassing Other Blacklisted Characters
        • Bypassing Blacklisted Commands
        • Advanced Command Obfuscation
        • Skills Assessment
      • File Upload Attacks
        • Absent Validation
        • Upload Exploitation
        • Client-Side Validation
        • Blacklist Filters
        • Whitelist Filters
        • Type Filters
        • Limited File Uploads
        • Skills Assessment
      • Server-side attacks
        • SSRF
          • Identifying SSRF
          • Exploiting SSRF
          • Blind SSRF
        • SSTI
          • Identifying SSTI
          • Exploiting SSTI - Jinja2
          • Exploiting SSTI - Twig
        • SSI Injection
        • Exploiting XSLT Injection
        • Skills Assessment
      • Login Brute Forcing
        • Brute Force Attacks
        • Dictionary Attacks
        • Basic Authentication
        • Login Forms
        • Web Services
        • Custom Wordlists
        • Skills Assessment Part 1
        • Skills Assessment Part 2
      • Broken Authentication
        • Brute-Force Attacks
        • Brute-Forcing Passwords
        • Brute-Forcing Password Reset Tokens
        • Brute-Forcing 2FA Codes
        • Vulnerable Password Reset
        • Authentication Bypass via Direct Access
        • Authentication Bypass via Parameter Modification
        • Attacking Session Tokens
        • Skills Assessment
      • Web Attacks
        • Bypassing Basic Authentication
        • Bypassing Security Filters
        • Mass IDOR Enumeration
        • Bypassing Encoded References
        • IDOR in Insecure APIs
        • Chaining IDOR Vulnerabilities
        • Local File Disclosure
        • Advanced File Disclosure
        • Blind Data Exfiltration
        • Skills Assessment
      • File Inclusion
        • Local File Inclusion (LFI)
        • Basic Bypasses
        • PHP Filters
        • PHP Wrappers
        • Remote File Inclusion (RFI)
        • LFI and File Uploads
        • Log Poisoning
        • Automated Scanning
        • File Inclusion Prevention
        • Skills Assessment
      • Session Security
        • Skill Assessment
      • Web Service & API Attacks
        • Skills Assessment
      • Hacking WordPress
  • 🌐Web Applications
    • 📒Enumeration
      • Passive Subdomain Enumeration
      • Passive Infrastructure Identification
      • Active Infrastructure Enumeration
      • Active Subdomain Enumeration
      • Virtual Hosts
      • Crawling
      • Fuzzing
      • Wordlists
    • ⌨️Code Analysis
    • Cross-Site Scripting (XSS)
      • XSS Attacks
      • XSS Prevention
    • Login Brute Forcing
      • Password Security Fundamentals
      • Brute Force Attacks
        • Dictionary Attacks
        • Hybrid Attacks
      • Hydra
        • Basic HTTP authentication
        • Login Forms
      • Medusa
        • Web Services
      • Custom Wordlists
    • Broken Authentication
      • What is Authentication
      • Attacks on Authentication
      • Brute-Force Attacks
        • Enumerating Users
        • Brute-Forcing Passwords
        • Brute-Forcing Password Reset Tokens
        • Brute-Forcing 2FA Codes
        • Weak Brute-Force Protection
      • Password Attacks
        • Default Credentials
        • Vulnerable Password Reset
      • Authentication Bypasses
        • Authentication Bypass via Direct Access
        • Authentication Bypass via Parameter Modification
      • Session Attacks
        • Attacking Session Tokens
        • Further Session Attacks
    • Web Attacks
      • HTTP Verb Tampering
        • Bypassing Basic Authentication
        • Bypassing Security Filters
        • Verb Tampering Prevention
      • Insecure Direct Object References
        • Identifying IDORs
        • Mass IDOR Enumeration
        • Bypassing Encoded References
        • IDOR in Insecure APIs
        • Chaining IDOR Vulnerabilities
        • IDOR Prevention
      • XML External Entity (XXE) Injection
        • Local File Disclosure
        • Advanced File Disclosure
        • Blind Data Exfiltration
        • XXE Prevention
    • Session Security
      • Session Hijacking
      • Session Fixation
      • Obtaining Session Identifiers without User Interaction
      • Cross-Site Scripting (XSS)
      • Cross-Site Request Forgery (CSRF or XSRF)
      • Cross-Site Request Forgery (GET-based)
      • Cross-Site Request Forgery (POST-based)
      • XSS & CSRF Chaining
      • Exploiting Weak CSRF Tokens
      • Additional CSRF Protection Bypasses
      • Open Redirect
      • Remediation Advice
    • Web Service & API Attacks
      • API Attacks
      • Arbitrary File Upload
      • Local File Inclusion (LFI)
      • Cross-Site Scripting (XSS)
      • Server-Side Request Forgery (SSRF)
      • Regular Expression Denial of Service (ReDoS)
      • XML External Entity (XXE) Injection
    • WordPress
      • Intro
        • WordPress Structure
        • WordPress User Roles
      • Enumeration
        • WordPress Core Version Enumeration
        • Plugins and Themes Enumeration
        • Directory Indexing
        • User Enumeration
        • Login
        • WPSCan Enumeration
  • 👾Server-side vulnerabilities
    • Path traversal
    • Access control
      • Vertical privilege escalation
      • Unprotected functionality
      • Parameter-based access control methods
      • Horizontal privilege escalation
      • Horizontal to vertical privilege escalation
    • Authentication vulnerabilities
    • Server-side request forgery
    • File upload vulnerabilities
    • OS command injection
      • Exploitation
      • Filter Evasion
      • Prevention
    • SQL Injection
      • SQL Injection Using Comments
      • SQL Injection Using Union Clauses
      • Union Injection
      • Exploitation
        • Database Enumeration
        • Reading Files
      • Lab: SQL injection vulnerability in WHERE clause allowing retrieval of hidden data
    • Server-side Attacks
      • SSRF
        • Identifying
        • Exploiting
        • Blind SSRF
        • Preventing SSRF
      • SSTI
        • Identifying
        • Exploiting SSTI - Jinja2
        • Exploiting SSTI - Twig
        • Futher Remarks
        • SSTI Tools of the Trade & Preventing SSTI
      • SSI Injection
        • Exploiting SSI Injection
        • Preventing SSI Injection
      • XSLT Injection
        • Exploiting XSLT Injection
        • Preventing XSLT Injection
    • File Inclusion
      • File Disclosure
        • Local File Inclusion (LFI)
        • Basic Bypasses
        • PHP Filters
      • Remote Code Execution
        • PHP Wrappers
        • Remote File Inclusion (RFI)
        • LFI and File Uploads
        • Log Poisoning
      • Autometed Scanning
      • File Inclusion Prevention
  • 🖥️Active Directory
  • 🐚Shells
    • Netcat
    • Socat
    • Common Shell Payloads
    • msfvenom
    • Metasploit multi/handler
    • WebShells
    • What's next?
  • ⤴️Privilege Escalation
    • 🐧Linux Privilege Escalation
      • Kernel Exploits
      • SUID
      • Capabilities
      • Cron jobs
      • PATH
      • NFS
      • THM Capstone Challenge
    • 🪟Windows Privilege Escalation
  • ⚒️Projects
    • USB stick awareness
  • Wordlists
  • Tools
  • Interesting Files
Powered by GitBook
On this page
  1. 🧪CTF / Labs
  2. HTB Certified Bug Bounty Hunter

File Inclusion

Local File Inclusion (LFI)Basic BypassesPHP FiltersPHP WrappersRemote File Inclusion (RFI)LFI and File UploadsLog PoisoningAutomated ScanningFile Inclusion PreventionSkills Assessment
PreviousSkills AssessmentNextLocal File Inclusion (LFI)