From the course: CompTIA Cybersecurity Analyst (CySA+) (CS0-003) Cert Prep (2024)

Unlock the full course today

Join today to access over 24,900 courses taught by industry experts.

File inclusion

File inclusion

From the course: CompTIA Cybersecurity Analyst (CySA+) (CS0-003) Cert Prep (2024)

Start my 1-month free trial Buy for my team

File inclusion

“

- [Instructor] File Inclusion Attacks take directory traversal to the next level. Instead of simply retrieving a file from the local operating system and displaying it to the attacker, File Inclusion Attacks actually execute the code contained within a file, allowing the attacker to fool the web server into executing arbitrary code. File Inclusion Attacks come in two variants. Local File Inclusion Attacks, or LFI Attacks, seek to execute code stored in a file located elsewhere on the web server. They work in a manner very similar to a directory traversal attack. For example, an attacker might use the URL shown here to execute a file named attack.exe that's stored in the uploads directory on a Windows server. Remote File Inclusion, or RFI Attacks, allow the attacker to go a step further and execute code that's stored on a remote server. These attacks are especially dangerous because the attacker can directly control the code being executed without having to first store a file on the…

Contents