A vulnerability which enables attackers to add their own files on a server via a web browser. Such vulnerability arises when an application adds files without proper validation of inputs, thereby enabling the attacker to modify the input and embed path traversal characters.

A vulnerability which enables attackers to add their own files on a server via a web browser. Such vulnerability arises when an application adds files without proper validation of inputs, thereby enabling the attacker to modify the input and embed path traversal characters.

• A. Local File Inclusion (LFI)
• B. Directory Traversal Attack
• C. Cross-Site Scripting
• D. SQL Injection

Answer: (A)

Local File Inclusion happens when a web application loads a file from the server based on user-supplied input. If the app doesn’t validate or sanitize that input, an attacker can craft a path that uses traversal characters (like ../) to escape the intended directory and reference other files on the server. This can allow the attacker to load a file they control (or a sensitive server file) through the same inclusion mechanism, potentially leading to code execution or information disclosure. The vulnerability is exposed through the browser by placing a manipulated file path in a parameter that the server uses to decide which file to load. Path traversal is the technique used to reach the attacker’s file, and the inclusion step is what makes the attack powerful, as the server will process the file as if it were a legitimate part of the application. This is distinct from general directory traversal, which focuses on reading files; Local File Inclusion specifically abuses the server’s file-loading function to bring in those files.

Local File Inclusion happens when a web application loads a file from the server based on user-supplied input. If the app doesn’t validate or sanitize that input, an attacker can craft a path that uses traversal characters (like ../) to escape the intended directory and reference other files on the server. This can allow the attacker to load a file they control (or a sensitive server file) through the same inclusion mechanism, potentially leading to code execution or information disclosure.

The vulnerability is exposed through the browser by placing a manipulated file path in a parameter that the server uses to decide which file to load. Path traversal is the technique used to reach the attacker’s file, and the inclusion step is what makes the attack powerful, as the server will process the file as if it were a legitimate part of the application. This is distinct from general directory traversal, which focuses on reading files; Local File Inclusion specifically abuses the server’s file-loading function to bring in those files.