{"id":477856,"date":"2023-08-09T09:21:22","date_gmt":"2023-08-09T09:21:22","guid":{"rendered":""},"modified":"2023-09-05T11:15:34","modified_gmt":"2023-09-05T11:15:34","slug":"local-file-inclusion","status":"publish","type":"wiki","link":"https:\/\/oneproxy.pro\/cn\/wiki\/local-file-inclusion\/","title":{"rendered":"\u672c\u5730\u6587\u4ef6\u5305\u542b"},"content":{"rendered":"<p>\u672c\u5730\u6587\u4ef6\u5305\u542b (LFI) \u662f\u4e00\u79cd\u5b89\u5168\u6f0f\u6d1e\uff0c\u5f53\u653b\u51fb\u8005\u80fd\u591f\u64cd\u7eb5\u5f15\u7528\u5177\u6709\u201c\u70b9-\u70b9-\u659c\u6760 (..\/)\u201d\u5e8f\u5217\u53ca\u5176\u53d8\u4f53\u7684\u6587\u4ef6\u7684\u53d8\u91cf\u65f6\uff0c\u5c31\u4f1a\u51fa\u73b0\u8be5\u6f0f\u6d1e\u3002\u8fd9\u4f7f\u5f97\u653b\u51fb\u8005\u53ef\u4ee5\u8bbf\u95ee\u5e76\u5305\u542b\u7528\u6237\u4e0d\u5e0c\u671b\u8bbf\u95ee\u7684\u6587\u4ef6\u3002<\/p>\n<h2>\u672c\u5730\u6587\u4ef6\u5305\u542b\u7684\u8d77\u6e90\u548c\u9996\u6b21\u63d0\u53ca\u7684\u5386\u53f2<\/h2>\n<p>\u968f\u7740 Web \u5e94\u7528\u7a0b\u5e8f\u548c\u52a8\u6001\u5185\u5bb9\u7684\u5174\u8d77\uff0c\u201c\u672c\u5730\u6587\u4ef6\u5305\u542b\u201d\u4e00\u8bcd\u5728 2000 \u5e74\u4ee3\u521d\u671f\u53d8\u5f97\u6d41\u884c\u8d77\u6765\u3002\u8be5\u6f0f\u6d1e\u9996\u5148\u5728\u5404\u79cd\u5b89\u5168\u8bba\u575b\u548c\u90ae\u4ef6\u5217\u8868\u4e2d\u516c\u5f00\u8ba8\u8bba\uff0c\u4e13\u5bb6\u4eec\u5f00\u59cb\u8bc6\u522b\u4e0e\u7528\u6237\u63d0\u4f9b\u7684\u8f93\u5165\u9a8c\u8bc1\u4e0d\u5f53\uff08\u5141\u8bb8\u672a\u7ecf\u6388\u6743\u7684\u6587\u4ef6\u8bbf\u95ee\uff09\u76f8\u5173\u7684\u98ce\u9669\u3002<\/p>\n<h2>\u6709\u5173\u672c\u5730\u6587\u4ef6\u5305\u542b\u7684\u8be6\u7ec6\u4fe1\u606f\uff1a\u6269\u5c55\u4e3b\u9898<\/h2>\n<p>\u672c\u5730\u6587\u4ef6\u5305\u542b\u53ef\u80fd\u4f1a\u5e26\u6765\u4e25\u91cd\u7684\u5b89\u5168\u98ce\u9669\uff0c\u7279\u522b\u662f\u5f53\u5b83\u5bfc\u81f4\u8fdc\u7a0b\u6587\u4ef6\u5305\u542b (RFI) \u65f6\uff0c\u653b\u51fb\u8005\u53ef\u80fd\u80fd\u591f\u6267\u884c\u4efb\u610f\u4ee3\u7801\u3002 LFI \u53ef\u4ee5\u51fa\u73b0\u5728\u5404\u79cd Web \u5e94\u7528\u7a0b\u5e8f\u6846\u67b6\u4e2d\uff0c\u4f8b\u5982 PHP\u3001JSP\u3001ASP \u7b49\u3002<\/p>\n<h3>LFI \u7684\u539f\u56e0\uff1a<\/h3>\n<ul>\n<li>\u7f3a\u4e4f\u9002\u5f53\u7684\u8f93\u5165\u9a8c\u8bc1<\/li>\n<li>Web \u670d\u52a1\u5668\u914d\u7f6e\u9519\u8bef<\/li>\n<li>\u4e0d\u5b89\u5168\u7684\u7f16\u7801\u5b9e\u8df5<\/li>\n<\/ul>\n<h3>LFI \u7684\u5f71\u54cd\uff1a<\/h3>\n<ul>\n<li>\u672a\u7ecf\u6388\u6743\u8bbf\u95ee\u6587\u4ef6<\/li>\n<li>\u654f\u611f\u4fe1\u606f\u6cc4\u9732<\/li>\n<li>\u8fdb\u4e00\u6b65\u5229\u7528\u4ee3\u7801\u6267\u884c\u7b49\u6f5c\u529b<\/li>\n<\/ul>\n<h2>\u672c\u5730\u6587\u4ef6\u5305\u542b\u7684\u5185\u90e8\u7ed3\u6784\uff1a\u5b83\u662f\u5982\u4f55\u5de5\u4f5c\u7684<\/h2>\n<p>\u5f53 Web \u5e94\u7528\u7a0b\u5e8f\u4f7f\u7528\u7528\u6237\u63d0\u4f9b\u7684\u8f93\u5165\u6765\u6784\u9020\u8981\u6267\u884c\u7684\u6587\u4ef6\u8def\u5f84\u65f6\uff0c\u901a\u5e38\u4f1a\u53d1\u751f LFI\u3002<\/p>\n<ol>\n<li><strong>\u7528\u6237\u8f93\u5165<\/strong>\uff1a\u653b\u51fb\u8005\u64cd\u7eb5\u8f93\u5165\u53c2\u6570\u3002<\/li>\n<li><strong>\u6587\u4ef6\u8def\u5f84\u6784\u5efa<\/strong>\uff1a\u5e94\u7528\u7a0b\u5e8f\u4f7f\u7528\u64cd\u7eb5\u7684\u8f93\u5165\u6784\u9020\u6587\u4ef6\u8def\u5f84\u3002<\/li>\n<li><strong>\u6587\u4ef6\u5305\u542b<\/strong>\uff1a\u5e94\u7528\u7a0b\u5e8f\u5305\u542b\u6784\u9020\u7684\u6587\u4ef6\u8def\u5f84\uff0c\u4ece\u800c\u5305\u542b\u610f\u5916\u7684\u6587\u4ef6\u3002<\/li>\n<\/ol>\n<h2>\u672c\u5730\u6587\u4ef6\u5305\u542b\u7684\u5173\u952e\u7279\u6027\u5206\u6790<\/h2>\n<ul>\n<li><strong>\u8def\u5f84\u7684\u64cd\u4f5c<\/strong>\uff1a\u901a\u8fc7\u64cd\u7eb5\u8def\u5f84\uff0c\u653b\u51fb\u8005\u53ef\u4ee5\u8bbf\u95ee\u53d7\u9650\u5236\u7684\u6587\u4ef6\u3002<\/li>\n<li><strong>\u6f5c\u5728\u7684\u5347\u7ea7<\/strong>\uff1aLFI \u53ef\u80fd\u5bfc\u81f4 RFI \u751a\u81f3\u4ee3\u7801\u6267\u884c\u3002<\/li>\n<li><strong>\u5bf9\u670d\u52a1\u5668\u914d\u7f6e\u7684\u4f9d\u8d56<\/strong>\uff1a\u67d0\u4e9b\u914d\u7f6e\u53ef\u80fd\u4f1a\u9632\u6b62\u6216\u6700\u5c0f\u5316 LFI \u98ce\u9669\u3002<\/li>\n<\/ul>\n<h2>\u672c\u5730\u6587\u4ef6\u5305\u542b\u7684\u7c7b\u578b\uff1a\u4f7f\u7528\u8868\u683c\u548c\u5217\u8868<\/h2>\n<table>\n<thead>\n<tr>\n<th>\u7c7b\u578b<\/th>\n<th>\u63cf\u8ff0<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>\u57fa\u672c LFI<\/td>\n<td>\u901a\u8fc7\u64cd\u7eb5\u8f93\u5165\u76f4\u63a5\u5305\u542b\u672c\u5730\u6587\u4ef6<\/td>\n<\/tr>\n<tr>\n<td>LFI \u81f3 RFI<\/td>\n<td>\u4f7f\u7528 LFI \u5bfc\u81f4\u8fdc\u7a0b\u6587\u4ef6\u5305\u542b<\/td>\n<\/tr>\n<tr>\n<td>\u5177\u6709\u4ee3\u7801\u6267\u884c\u529f\u80fd\u7684 LFI<\/td>\n<td>\u901a\u8fc7LFI\u5b9e\u73b0\u4ee3\u7801\u6267\u884c<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h2>\u4f7f\u7528\u672c\u5730\u6587\u4ef6\u5305\u542b\u7684\u65b9\u6cd5\u3001\u95ee\u9898\u53ca\u5176\u89e3\u51b3\u65b9\u6848<\/h2>\n<h3>\u4f7f\u7528\u65b9\u6cd5\uff1a<\/h3>\n<ul>\n<li>\u6d4b\u8bd5\u7cfb\u7edf\u5b89\u5168\u6027<\/li>\n<li>\u7528\u4e8e\u6f0f\u6d1e\u8bc4\u4f30\u7684\u9053\u5fb7\u9ed1\u5ba2<\/li>\n<\/ul>\n<h3>\u95ee\u9898\uff1a<\/h3>\n<ul>\n<li>\u8d8a\u6743\u5b58\u53d6<\/li>\n<li>\u6570\u636e\u6cc4\u9732<\/li>\n<li>\u7cfb\u7edf\u59a5\u534f<\/li>\n<\/ul>\n<h3>\u89e3\u51b3\u65b9\u6848\uff1a<\/h3>\n<ul>\n<li>\u8f93\u5165\u9a8c\u8bc1<\/li>\n<li>\u5b89\u5168\u7f16\u7801\u5b9e\u8df5<\/li>\n<li>\u5b9a\u671f\u5b89\u5168\u5ba1\u6838<\/li>\n<\/ul>\n<h2>\u4e3b\u8981\u7279\u70b9\u53ca\u5176\u4ed6\u4e0e\u540c\u7c7b\u4ea7\u54c1\u7684\u6bd4\u8f83<\/h2>\n<table>\n<thead>\n<tr>\n<th>\u5b66\u671f<\/th>\n<th>\u7279\u5f81<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>\u7ebf\u6027FI<\/td>\n<td>\u672c\u5730\u6587\u4ef6\u8bbf\u95ee<\/td>\n<\/tr>\n<tr>\n<td>\u5c04\u9891\u5e72\u6270<\/td>\n<td>\u8fdc\u7a0b\u6587\u4ef6\u8bbf\u95ee<\/td>\n<\/tr>\n<tr>\n<td>\u76ee\u5f55\u904d\u5386<\/td>\n<td>\u4e0e LFI \u7c7b\u4f3c\uff0c\u4f46\u8303\u56f4\u66f4\u5e7f<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h2>\u4e0e\u672c\u5730\u6587\u4ef6\u5305\u542b\u76f8\u5173\u7684\u672a\u6765\u524d\u666f\u548c\u6280\u672f<\/h2>\n<ul>\n<li><strong>\u5148\u8fdb\u7684\u5b89\u5168\u673a\u5236<\/strong>\uff1a\u9632\u6b62 LFI \u7684\u65b0\u6846\u67b6\u548c\u5de5\u5177\u3002<\/li>\n<li><strong>\u4eba\u5de5\u667a\u80fd\u9a71\u52a8\u7684\u76d1\u63a7<\/strong>\uff1a\u4f7f\u7528\u4eba\u5de5\u667a\u80fd\u6765\u68c0\u6d4b\u548c\u9632\u6b62\u6f5c\u5728\u7684 LFI \u653b\u51fb\u3002<\/li>\n<li><strong>\u6cd5\u5f8b\u6846\u67b6<\/strong>\uff1a\u7ba1\u7406\u7f51\u7edc\u5b89\u5168\u7684\u53ef\u80fd\u7684\u6cd5\u5f8b\u5f71\u54cd\u548c\u6cd5\u89c4\u3002<\/li>\n<\/ul>\n<h2>\u5982\u4f55\u4f7f\u7528\u4ee3\u7406\u670d\u52a1\u5668\u6216\u5982\u4f55\u5c06\u4ee3\u7406\u670d\u52a1\u5668\u4e0e\u672c\u5730\u6587\u4ef6\u5305\u542b\u5173\u8054<\/h2>\n<p>OneProxy \u7b49\u4ee3\u7406\u670d\u52a1\u5668\u53ef\u7528\u4f5c\u5b89\u5168\u5c42\u6765\u76d1\u89c6\u548c\u8fc7\u6ee4\u53ef\u80fd\u5bfc\u81f4 LFI \u7684\u8bf7\u6c42\u3002\u901a\u8fc7\u6b63\u786e\u7684\u914d\u7f6e\u3001\u65e5\u5fd7\u8bb0\u5f55\u548c\u626b\u63cf\uff0c\u4ee3\u7406\u670d\u52a1\u5668\u53ef\u4ee5\u9488\u5bf9\u6b64\u7c7b\u6f0f\u6d1e\u6dfb\u52a0\u989d\u5916\u7ea7\u522b\u7684\u4fdd\u62a4\u3002<\/p>\n<h2>\u76f8\u5173\u94fe\u63a5<\/h2>\n<ul>\n<li><a href=\"https:\/\/www.owasp.org\/index.php\/Testing_for_Local_File_Inclusion\" target=\"_new\" rel=\"noopener nofollow\">LFI \u7684 OWASP \u6307\u5357<\/a><\/li>\n<li><a href=\"https:\/\/cwe.mitre.org\/data\/definitions\/98.html\" target=\"_new\" rel=\"noopener nofollow\">LFI \u7684\u5e38\u89c1\u5f31\u70b9\u679a\u4e3e (CWE)<\/a><\/li>\n<li><a href=\"https:\/\/oneproxy.pro\/cn\/\" target=\"_new\" rel=\"noopener\">OneProxy \u5b89\u5168\u670d\u52a1<\/a><\/li>\n<\/ul>\n<p>\uff08\u6ce8\uff1a\u53d1\u8868\u6587\u7ae0\u524d\uff0c\u8bf7\u786e\u4fdd\u6240\u6709\u94fe\u63a5\u548c\u4fe1\u606f\u5747\u7b26\u5408OneProxy\u7684\u670d\u52a1\u548c\u653f\u7b56\u3002\uff09<\/p>","protected":false},"featured_media":477857,"menu_order":0,"template":"","meta":{"_acf_changed":false,"content-type":"","inline_featured_image":false,"footnotes":""},"class_list":["post-477856","wiki","type-wiki","status-publish","has-post-thumbnail","hentry"],"acf":{"faq_title":"Frequently Asked Questions about <mark>Local File Inclusion: A Comprehensive Guide<\/mark>","faq_items":[{"question":"What is Local File Inclusion (LFI)?","answer":"<p>Local File Inclusion (LFI) is a security vulnerability that arises when an attacker manipulates input variables containing \"..\/\" sequences to access and include files not intended for public access. This flaw can lead to unauthorized file access and potential exploitation.<\/p>"},{"question":"How did Local File Inclusion (LFI) emerge?","answer":"<p>LFI gained attention in the early 2000s with the proliferation of dynamic web applications. Security experts began discussing this vulnerability on various forums and mailing lists as they identified risks associated with improper validation of user-supplied input.<\/p>"},{"question":"What are the main characteristics of Local File Inclusion (LFI)?","answer":"<p>The key features of LFI include the ability to manipulate file paths, potential escalation to remote file inclusion (RFI) or code execution, and its dependence on server configurations.<\/p>"},{"question":"What are the different types of Local File Inclusion (LFI)?","answer":"<p>LFI can manifest in various ways, including basic LFI where local files are directly accessed, LFI leading to RFI, and LFI exploited for code execution.<\/p>"},{"question":"How does Local File Inclusion (LFI) work?","answer":"<p>LFI occurs when a web application constructs a file path using user-supplied input, which is manipulated by the attacker. This leads to the inclusion of unintended files.<\/p>"},{"question":"What are the potential problems caused by Local File Inclusion (LFI)?","answer":"<p>LFI can result in unauthorized access to sensitive files, leakage of confidential information, and even system compromise if combined with code execution.<\/p>"},{"question":"How can Local File Inclusion (LFI) be prevented?","answer":"<p>To mitigate LFI risks, developers must implement proper input validation, adhere to secure coding practices, and conduct regular security audits.<\/p>"},{"question":"How can proxy servers like OneProxy be associated with Local File Inclusion (LFI)?","answer":"<p>Proxy servers, like OneProxy, can enhance security against LFI by monitoring and filtering requests that may lead to such vulnerabilities, adding an extra layer of protection to web applications.<\/p>"},{"question":"What does the future hold for Local File Inclusion (LFI) prevention?","answer":"<p>As technology evolves, we can expect advanced security mechanisms, AI-driven monitoring, and potential legal frameworks to address LFI risks and enhance web application security.<\/p>"}]},"_links":{"self":[{"href":"https:\/\/oneproxy.pro\/cn\/wp-json\/wp\/v2\/wiki\/477856","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/oneproxy.pro\/cn\/wp-json\/wp\/v2\/wiki"}],"about":[{"href":"https:\/\/oneproxy.pro\/cn\/wp-json\/wp\/v2\/types\/wiki"}],"version-history":[{"count":0,"href":"https:\/\/oneproxy.pro\/cn\/wp-json\/wp\/v2\/wiki\/477856\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/oneproxy.pro\/cn\/wp-json\/wp\/v2\/media\/477857"}],"wp:attachment":[{"href":"https:\/\/oneproxy.pro\/cn\/wp-json\/wp\/v2\/media?parent=477856"}],"curies":[{"name":"\u53ef\u6e7f\u6027\u7c89\u5242","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}