In this section, we are going to use an example of a Damn Vulnerable Web Application (DVWA). We will write an exploit for local and remote file inclusion and ensure that we get a reverse shell by executing the exploit. As we know, DVWA has many vulnerabilities, which include Local File Inclusion (LFI) and Remote File Inclusion (RFI).
Local file inclusion is a category of vulnerability typically found in PHP applications and is introduced by the improper usage of the include() and require() functions. The include() function is used to include a PHP module in the current PHP file from where it is invoked. There are occasions in which the developer takes the name of the file to be included as an input parameter from the web application, which can then be misused by attackers. An attacker can tweak the input parameter and can read...
