View source for File Inclusion

File inclusion refers to the process of manipulating unsanitised inputs that make use of PHP's include() function into including files that were not intended to be included. This can be used for the disclosure of privileged information (such as the contents of the /etc/shadow file) or including a file that contains some arbitrary code created by the attacker, and thus causing the server to run this code. <b>File inclusion</b> refers in a general sense to the inclusion of an unintended file, whereas <b>file disclosure</b> refers specifically to using file inclusion to obtain sensitive information.

File inclusion is a vulnerability that exists because of [[PHP]]'s include() function accepting a variable as a parameter.  
__FORCETOC__
=Introduction=
{{:File_Inclusion/Introduction}}
=Remote File Inclusion=
{{:File_Inclusion/Remote_File_Inclusion}}
=Local File Inclusion=
{{:File_Inclusion/Local_File_Inclusion}}

{{exploitation}}

[[category:Web exploitation]]