hackXpert labs
All labs › Local File Inclusion

📁 Local File Inclusion

Find the parameter that names a file, then walk upwards until the application stops you - and work out why it stopped you.

4 labs and targetsfree accountlesson included
How files & paths actually works — taught by The XSS Rat

What it is

Anywhere a filename or a path reaches the filesystem, the question is whether you can steer it. Include a local file, include a remote one, or upload something the server is willing to execute - all three come from the same trust mistake.

How I attack it

  1. Find the parameter that names a file, then walk upwards and see where the app stops you.
  2. If a prefix or suffix is added, work with it: known directories, null bytes on old stacks, encoding tricks against a weak filter.
  3. For uploads, separate the three checks - extension, content type and content - and defeat them one at a time.
  4. Know what you want to read before you start: configs, credentials, source, and on Linux /proc for the quick wins.

Learn it from The XSS Rat

▶ Watch: LFI on YouTube ✍ Read: file upload on Medium 🎓 Course: Beginner Web Hacking Bundle

Free reference reading

PortSwigger Academy: path traversalPortSwigger Academy: file uploadHackTricks: file inclusionPayloadsAllTheThings: insecure upload

The set 4

The filesystem these read is not this server’s. Every path resolves inside a small invented Linux box that ships with the labs, so the payloads are the real ones and the files that come back are planted - including a few worth finding. Your traversal is not failing; you are reading someone else’s machine.

Endpoint 2

A filter strips the slashes out of your path. It has an off switch.

Endpoint 3

The same filter, plus a blocklist for the filename it expects.

Also here 1

Solutions
Nothing matches thatClear the filter to see everything again.