Testing for LFI
Web servers control access to privileged files and resources using configuration settings. Privileged files include files that should only be accessible to system administrators – for example, the /etc/passwd file on Unix-like platforms or the boot.ini file on Windows systems.
An LFI attack is an attempt to access privileged files using directory traversal attacks. LFI attacks include different styles, including dot-dot-slash attacks (../), directory brute-forcing, directory climbing, or backtracking.
Getting ready
Using OWASP Mutillidae II as our target application, let’s determine whether it contains any LFI vulnerabilities.
Ensure Burp Suite and OWASP BWA VM are running and that Burp Suite is configured in the Firefox browser used to view the OWASP BWA applications.
How to do it...
- From the OWASP BWA Landing page, click the link to the OWASP Mutillidae II application.
- Open the login screen of OWASP Mutillidae II in the Firefox...
