# 6. LFI and File Uploads

**Key Takeaways:**

* **LFI and File Upload Synergy:**
  * File uploads, even seemingly secure ones, can be leveraged with LFI.
  * The LFI vulnerability is the primary attack vector.
  * File uploads provide a way to place malicious code on the server.
* **Image Upload Technique:**
  * Crafting a malicious image file with embedded PHP code.
  * Using valid image magic bytes and extensions.
  * Uploading the malicious image through a standard upload form.
  * Retrieving the uploaded file's path.
  * Including the uploaded file via LFI to execute the embedded code.
* **Zip Upload Technique:**
  * Creating a zip archive containing a PHP web shell.
  * Uploading the zip archive.
  * Using the `zip://` wrapper to include the zipped PHP script.
  * Good to note that this method relies on the zip extension being enabled.
* **Phar Upload Technique:**
  * Creating a `phar` archive with embedded PHP code.
  * Uploading the `phar` archive.
  * Using the `phar://` wrapper to include and execute the embedded code.
  * Again, good to note that this method relies on the phar extension being enabled.
* **Importance of Code Execution:**
  * The LFI vulnerability must allow code execution for these techniques to work.
  * Functions like `include()` and `require()` are vulnerable.
* **Path Discovery:**
  * The explanation correctly states that the location of the uploaded file must be found. Methods of finding the location are covered.

**Additional Considerations:**

* **Real-World Scenarios:**
  * Attackers often use more sophisticated web shells and payloads.
  * WAFs and other security measures can hinder these attacks.
  * Defense in depth is very important.
* **File Type Validation:**
  * While the explanation focuses on bypassing extension checks, content-type validation is also common.
  * Attackers may use techniques to bypass content-type checks.
* **Security Best Practices:**
  * Proper input validation and sanitization are crucial.
  * Restricting file uploads to specific file types and sizes.
  * Storing uploaded files outside the web root.
  * Disabling or restricting file inclusion functions.
* **PHP Configuration:**
  * The zip\://, and phar:// wrappers rely on php extensions. Disabling unneeded extensions is a good security practice.
* **Magic Bytes:**
  * Understanding magic bytes is essential for crafting malicious files.
  * Tools like `file` can help identify file types and magic bytes.
* **Defense in Depth:**
  * Combining multiple security measures is essential.
  * Regular security audits and penetration testing.
