Beginners Guide to LFD

Local File Disclosure (LFD), also known as Local File Inclusion (LFI) when chaining with RCE, is a vulnerability that allows an attacker to read arbitrary files from the server’s local filesystem. This typically arises when a web application reads files based on user input without proper validation or sanitization.

🔓 An LFD bug might let you read sensitive files like /etc/passwd, .env, or app config files containing API keys, database credentials, or session secrets.

⚠️ Why It’s Dangerous

LFD vulnerabilities can be leveraged to:

• 🗝️ Read configuration files and environment variables
• 🕵️ Disclose sensitive user or system data
• 🔍 Enumerate users and services
• ⛓️ Chain with other vulnerabilities (e.g., log poisoning → RCE)

🔬 Anatomy of an LFD Vulnerability

Suppose any website allows the user to fetch a image from the following endpoint

GET https://mybankingsite.com/view_file?image=/images/myavatar.jpeg HTTP/1.1

An attacker could change the path in the following manner to read a local file on the system, [This depends on how the application is implemented]

GET https://mybankingsite.com/view_file?image=../../../../../etc/passwd HTTP/1.1

Boom 💥 the contents of /etc/passwd might get exposed.

📌 Pro Tip: Always try prepending your payload with ./ (current directory) to test how the app handles relative paths.

Try:

./etc/passwd
../../../../etc/passwd
....//....//....//etc/passwd

Sometimes the application may expect a extension or will automatically add it to the end of the request.

For Ex

GET http://mybankingsite.com/transaction?u=username HTTP/1.1 

will give us a csv file named username.csv

This can be bypassed by adding a nullbyte(%00) in some cases by adding a ”?” or other characters, depending on how the application works

GET http://mybankingsite.com/transaction?u=/etc/passwd?%00 HTTP/1.1

this may give us the content of etc/passwd file by ignoring the csv extension

🧙‍♂️ Filter Bypasses and Encodings

📌 NOTE: Some applications try to block traversal patterns like ../. Here’s how you can bypass:

URL Encoding:

.    ⇒ %2e
/    ⇒ %2f
../  ⇒ %2e%2e%2f

Bypass Tricks:

Try combining these creatively to evade filters.

Happy Hunting 🔍🐞