LFI labs

Local File Inclusion (LFI)

What is LFI?

Local File Inclusion happens when an app includes and processes a local file whose path the user controls. Beyond reading sensitive files, when the file is interpreted as code (PHP include) it escalates to RCE via log poisoning, PHP wrappers or /proc.

Why practice LFI?

LFI is still very present in legacy PHP apps and frameworks that include templates/languages by parameter. Its appeal is the escalation: from reading files to full RCE with techniques like log poisoning or php://filter. An LFI that reaches RCE is P1 with $3,000-$25,000 bounties.

What will you learn with the LFI labs?

You'll learn to detect inclusion parameters, read files with traversal and wrappers (php://filter to exfiltrate source code in base64), and the classic LFI-to-RCE chains: log poisoning, /proc/self/environ, data:// and php://input, plus filter and prefix bypasses.

Types of LFI we cover

Basic LFI
?page=../../../../etc/passwd — inclusion of arbitrary local files for reading.
php://filter
php://filter/convert.base64-encode/resource=index.php — exfiltrates the PHP source code in base64 without executing it.
Log poisoning → RCE
You inject PHP into a log (User-Agent) and then include it to execute it.
data:// / php://input wrappers
data://text/plain;base64,... or php://input to include code directly and achieve RCE.

How do you find and exploit LFI?

A practical playbook — from recon to proof of concept.

1
Detect the inclusion parameter
Parameters that load templates, languages or pages (page, file, lang, include, template) are the LFI candidates.
```
GET /index.php?page=home
```
2
Confirm local read
Replace the value with a traversal path to a known file. If its contents appear, there's local inclusion.
```
?page=../../../../../../etc/passwd
```
3
Exfiltrate code with php://filter
Use the filter wrapper so the PHP isn't executed and is returned in base64; decode it to read the source and hunt for secrets.
```
?page=php://filter/convert.base64-encode/resource=config.php
```
4
Escape filters and prefixes
If they strip ../ or force an extension, use nested sequences, double encoding or, on very old engines, the null byte.
```
....//....//etc/passwd   ·   %252e%252e%252f   ·   ...%00.php
```
5
Escalate to RCE
Poison a log or the session with PHP and include it again, or use data://, php://input or /proc/self/environ to run your code.
```
User-Agent: <?php system($_GET['c']); ?>  →  ?page=/var/log/nginx/access.log&c=id
```

Learn the theory

Academy: File Upload Vulnerabilities

Loading labs...

View in full catalog →

Frequently asked questions

What is Local File Inclusion (LFI)?

It's a vulnerability where the app includes a local file whose path the user controls. It lets you read sensitive files and, when the file is interpreted as code (typical in PHP include), escalate to remote command execution.

How is an LFI exploited?

You manipulate the inclusion parameter with traversal to read files (../../etc/passwd) or with wrappers like php://filter to exfiltrate source code. For RCE, you poison a log or the session with PHP and include it, or use data:// and php://input wrappers.

How do you find LFI in bug bounty?

Fuzz parameters that load pages, templates or languages (page, file, lang) with traversal payloads and wrappers. Legacy PHP apps and frameworks that include views by parameter are the most likely targets; php://filter helps confirm without triggering errors.

How do you prevent LFI?

Don't include files from user input; use an allowlist of pages/templates mapped server-side, canonicalize and validate the path inside the permitted directory, and disable dangerous wrappers and allow_url_include in PHP.

Difference between LFI and RFI?

LFI includes LOCAL files on the server; RFI (Remote File Inclusion) includes a REMOTE file from an attacker URL (requires allow_url_include). RFI gives RCE more directly, but today it's rare because that option is usually disabled; LFI is far more common.

Other related categories

Path Traversal

Path Traversal / Directory Traversal

Command Injection

OS Command Injection

SSRF

Server-Side Request Forgery (SSRF)

→ See all vulnerabilities → Free Academy → Pricing from €7.99/mo

hunters training: 650
labs from real reports: 50
completions: 380
in bounties practiced: $200,000

40 flags captured this week·Real reports from HackerOne · Bugcrowd · Intigriti·No commitment·Free Academy

BBLabs · bug bounty training

Practice LFI in real labs

Every LFI lab replicates a real bug bounty report that got paid. Create your free account, start with the Academy and move to the labs whenever you want.

Create free account See the labs

No card · free Academy · cancel anytime