{"id":477856,"date":"2023-08-09T09:21:22","date_gmt":"2023-08-09T09:21:22","guid":{"rendered":""},"modified":"2023-09-05T11:15:34","modified_gmt":"2023-09-05T11:15:34","slug":"local-file-inclusion","status":"publish","type":"wiki","link":"https:\/\/oneproxy.pro\/vn\/wiki\/local-file-inclusion\/","title":{"rendered":"Bao g\u1ed3m t\u1eadp tin c\u1ee5c b\u1ed9"},"content":{"rendered":"<p>Bao g\u1ed3m t\u1ec7p c\u1ee5c b\u1ed9 (LFI) l\u00e0 m\u1ed9t l\u1ed7 h\u1ed5ng b\u1ea3o m\u1eadt x\u1ea3y ra khi k\u1ebb t\u1ea5n c\u00f4ng c\u00f3 th\u1ec3 thao t\u00fang c\u00e1c bi\u1ebfn tham chi\u1ebfu c\u00e1c t\u1ec7p c\u00f3 chu\u1ed7i \u201cdot-dot-slash (..\/)\u201d v\u00e0 c\u00e1c bi\u1ebfn th\u1ec3 c\u1ee7a n\u00f3. \u0110i\u1ec1u n\u00e0y cho ph\u00e9p k\u1ebb t\u1ea5n c\u00f4ng truy c\u1eadp v\u00e0 bao g\u1ed3m c\u00e1c t\u1ec7p m\u00e0 ng\u01b0\u1eddi d\u00f9ng kh\u00f4ng c\u00f3 \u00fd \u0111\u1ecbnh truy c\u1eadp.<\/p>\n<h2>L\u1ecbch s\u1eed v\u1ec1 ngu\u1ed3n g\u1ed1c c\u1ee7a vi\u1ec7c bao g\u1ed3m t\u1ec7p c\u1ee5c b\u1ed9 v\u00e0 l\u1ea7n \u0111\u1ea7u ti\u00ean \u0111\u1ec1 c\u1eadp \u0111\u1ebfn n\u00f3<\/h2>\n<p>Thu\u1eadt ng\u1eef \u201cBao g\u1ed3m t\u1ec7p c\u1ee5c b\u1ed9\u201d tr\u1edf n\u00ean n\u1ed5i b\u1eadt v\u00e0o \u0111\u1ea7u nh\u1eefng n\u0103m 2000 v\u1edbi s\u1ef1 ph\u00e1t tri\u1ec3n c\u1ee7a c\u00e1c \u1ee9ng d\u1ee5ng web v\u00e0 n\u1ed9i dung \u0111\u1ed9ng. L\u1ed7 h\u1ed5ng n\u00e0y l\u1ea7n \u0111\u1ea7u ti\u00ean \u0111\u01b0\u1ee3c th\u1ea3o lu\u1eadn c\u00f4ng khai tr\u00ean nhi\u1ec1u di\u1ec5n \u0111\u00e0n b\u1ea3o m\u1eadt v\u00e0 danh s\u00e1ch g\u1eedi th\u01b0, n\u01a1i c\u00e1c chuy\u00ean gia b\u1eaft \u0111\u1ea7u x\u00e1c \u0111\u1ecbnh c\u00e1c r\u1ee7i ro li\u00ean quan \u0111\u1ebfn vi\u1ec7c x\u00e1c th\u1ef1c kh\u00f4ng \u0111\u00fang th\u00f4ng tin \u0111\u1ea7u v\u00e0o do ng\u01b0\u1eddi d\u00f9ng cung c\u1ea5p, cho ph\u00e9p truy c\u1eadp t\u1ec7p tr\u00e1i ph\u00e9p.<\/p>\n<h2>Th\u00f4ng tin chi ti\u1ebft v\u1ec1 vi\u1ec7c bao g\u1ed3m t\u1ec7p c\u1ee5c b\u1ed9: M\u1edf r\u1ed9ng ch\u1ee7 \u0111\u1ec1<\/h2>\n<p>Vi\u1ec7c \u0111\u01b0a v\u00e0o t\u1ec7p c\u1ee5c b\u1ed9 c\u00f3 th\u1ec3 l\u00e0 m\u1ed9t r\u1ee7i ro b\u1ea3o m\u1eadt nghi\u00eam tr\u1ecdng, \u0111\u1eb7c bi\u1ec7t n\u1ebfu n\u00f3 d\u1eabn \u0111\u1ebfn vi\u1ec7c \u0111\u01b0a v\u00e0o t\u1ec7p t\u1eeb xa (RFI), trong \u0111\u00f3 k\u1ebb t\u1ea5n c\u00f4ng c\u00f3 th\u1ec3 th\u1ef1c thi m\u00e3 t\u00f9y \u00fd. LFI c\u00f3 th\u1ec3 x\u1ea3y ra trong nhi\u1ec1u khung \u1ee9ng d\u1ee5ng web kh\u00e1c nhau nh\u01b0 PHP, JSP, ASP, v.v.<\/p>\n<h3>Nguy\u00ean nh\u00e2n c\u1ee7a LFI:<\/h3>\n<ul>\n<li>Thi\u1ebfu x\u00e1c nh\u1eadn \u0111\u1ea7u v\u00e0o th\u00edch h\u1ee3p<\/li>\n<li>M\u00e1y ch\u1ee7 web b\u1ecb \u0111\u1ecbnh c\u1ea5u h\u00ecnh sai<\/li>\n<li>Th\u1ef1c h\u00e0nh m\u00e3 h\u00f3a kh\u00f4ng an to\u00e0n<\/li>\n<\/ul>\n<h3>T\u00e1c \u0111\u1ed9ng c\u1ee7a LFI:<\/h3>\n<ul>\n<li>Truy c\u1eadp tr\u00e1i ph\u00e9p v\u00e0o c\u00e1c t\u1eadp tin<\/li>\n<li>R\u00f2 r\u1ec9 th\u00f4ng tin nh\u1ea1y c\u1ea3m<\/li>\n<li>Ti\u1ec1m n\u0103ng khai th\u00e1c s\u00e2u h\u01a1n nh\u01b0 th\u1ef1c thi m\u00e3<\/li>\n<\/ul>\n<h2>C\u1ea5u tr\u00fac b\u00ean trong c\u1ee7a vi\u1ec7c bao g\u1ed3m t\u1ec7p c\u1ee5c b\u1ed9: C\u00e1ch th\u1ee9c ho\u1ea1t \u0111\u1ed9ng<\/h2>\n<p>LFI th\u01b0\u1eddng x\u1ea3y ra khi m\u1ed9t \u1ee9ng d\u1ee5ng web s\u1eed d\u1ee5ng \u0111\u1ea7u v\u00e0o do ng\u01b0\u1eddi d\u00f9ng cung c\u1ea5p \u0111\u1ec3 x\u00e2y d\u1ef1ng \u0111\u01b0\u1eddng d\u1eabn t\u1ec7p \u0111\u1ec3 th\u1ef1c thi.<\/p>\n<ol>\n<li><strong>\u0110\u1ea7u v\u00e0o c\u1ee7a ng\u01b0\u1eddi d\u00f9ng<\/strong>: K\u1ebb t\u1ea5n c\u00f4ng thao t\u00fang c\u00e1c tham s\u1ed1 \u0111\u1ea7u v\u00e0o.<\/li>\n<li><strong>X\u00e2y d\u1ef1ng \u0111\u01b0\u1eddng d\u1eabn t\u1ec7p<\/strong>: \u1ee8ng d\u1ee5ng x\u00e2y d\u1ef1ng \u0111\u01b0\u1eddng d\u1eabn t\u1ec7p b\u1eb1ng c\u00e1ch s\u1eed d\u1ee5ng \u0111\u1ea7u v\u00e0o \u0111\u01b0\u1ee3c thao t\u00e1c.<\/li>\n<li><strong>Bao g\u1ed3m t\u1eadp tin<\/strong>: \u1ee8ng d\u1ee5ng bao g\u1ed3m \u0111\u01b0\u1eddng d\u1eabn t\u1ec7p \u0111\u01b0\u1ee3c x\u00e2y d\u1ef1ng, do \u0111\u00f3 bao g\u1ed3m c\u1ea3 t\u1ec7p ngo\u00e0i \u00fd mu\u1ed1n.<\/li>\n<\/ol>\n<h2>Ph\u00e2n t\u00edch c\u00e1c t\u00ednh n\u0103ng ch\u00ednh c\u1ee7a vi\u1ec7c \u0111\u01b0a t\u1ec7p c\u1ee5c b\u1ed9 v\u00e0o<\/h2>\n<ul>\n<li><strong>Thao t\u00e1c \u0111\u01b0\u1eddng d\u1eabn<\/strong>: B\u1eb1ng c\u00e1ch thao t\u00fang c\u00e1c \u0111\u01b0\u1eddng d\u1eabn, k\u1ebb t\u1ea5n c\u00f4ng c\u00f3 th\u1ec3 truy c\u1eadp c\u00e1c t\u1ec7p b\u1ecb h\u1ea1n ch\u1ebf.<\/li>\n<li><strong>Kh\u1ea3 n\u0103ng leo thang<\/strong>: LFI c\u00f3 th\u1ec3 d\u1eabn \u0111\u1ebfn RFI ho\u1eb7c th\u1eadm ch\u00ed l\u00e0 th\u1ef1c thi m\u00e3.<\/li>\n<li><strong>S\u1ef1 ph\u1ee5 thu\u1ed9c v\u00e0o c\u1ea5u h\u00ecnh m\u00e1y ch\u1ee7<\/strong>: M\u1ed9t s\u1ed1 c\u1ea5u h\u00ecnh nh\u1ea5t \u0111\u1ecbnh c\u00f3 th\u1ec3 ng\u0103n ng\u1eeba ho\u1eb7c gi\u1ea3m thi\u1ec3u r\u1ee7i ro LFI.<\/li>\n<\/ul>\n<h2>C\u00e1c lo\u1ea1i bao g\u1ed3m t\u1ec7p c\u1ee5c b\u1ed9: S\u1eed d\u1ee5ng b\u1ea3ng v\u00e0 danh s\u00e1ch<\/h2>\n<table>\n<thead>\n<tr>\n<th>Ki\u1ec3u<\/th>\n<th>S\u1ef1 mi\u00eau t\u1ea3<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>LFI c\u01a1 b\u1ea3n<\/td>\n<td>Bao g\u1ed3m tr\u1ef1c ti\u1ebfp c\u00e1c t\u1ec7p c\u1ee5c b\u1ed9 th\u00f4ng qua \u0111\u1ea7u v\u00e0o \u0111\u01b0\u1ee3c thao t\u00e1c<\/td>\n<\/tr>\n<tr>\n<td>LFI sang RFI<\/td>\n<td>S\u1eed d\u1ee5ng LFI \u0111\u1ec3 \u0111\u01b0a t\u1eadp tin t\u1eeb xa v\u00e0o<\/td>\n<\/tr>\n<tr>\n<td>LFI v\u1edbi vi\u1ec7c th\u1ef1c thi m\u00e3<\/td>\n<td>\u0110\u1ea1t \u0111\u01b0\u1ee3c vi\u1ec7c th\u1ef1c thi m\u00e3 th\u00f4ng qua LFI<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h2>C\u00e1c c\u00e1ch s\u1eed d\u1ee5ng t\u00ednh n\u0103ng bao g\u1ed3m t\u1ec7p c\u1ee5c b\u1ed9, c\u00e1c v\u1ea5n \u0111\u1ec1 v\u00e0 gi\u1ea3i ph\u00e1p c\u1ee7a ch\u00fang<\/h2>\n<h3>C\u00e1ch s\u1eed d\u1ee5ng:<\/h3>\n<ul>\n<li>Ki\u1ec3m tra t\u00ednh b\u1ea3o m\u1eadt c\u1ee7a h\u1ec7 th\u1ed1ng<\/li>\n<li>Hack \u0111\u1ea1o \u0111\u1ee9c \u0111\u1ec3 \u0111\u00e1nh gi\u00e1 l\u1ed7 h\u1ed5ng<\/li>\n<\/ul>\n<h3>C\u00e1c v\u1ea5n \u0111\u1ec1:<\/h3>\n<ul>\n<li>Truy c\u1eadp tr\u00e1i ph\u00e9p<\/li>\n<li>R\u00f2 r\u1ec9 d\u1eef li\u1ec7u<\/li>\n<li>S\u1ef1 th\u1ecfa hi\u1ec7p h\u1ec7 th\u1ed1ng<\/li>\n<\/ul>\n<h3>C\u00e1c gi\u1ea3i ph\u00e1p:<\/h3>\n<ul>\n<li>X\u00e1c th\u1ef1c \u0111\u1ea7u v\u00e0o<\/li>\n<li>Th\u1ef1c h\u00e0nh m\u00e3 h\u00f3a an to\u00e0n<\/li>\n<li>Ki\u1ec3m tra an ninh th\u01b0\u1eddng xuy\u00ean<\/li>\n<\/ul>\n<h2>C\u00e1c \u0111\u1eb7c \u0111i\u1ec3m ch\u00ednh v\u00e0 nh\u1eefng so s\u00e1nh kh\u00e1c v\u1edbi c\u00e1c thu\u1eadt ng\u1eef t\u01b0\u01a1ng t\u1ef1<\/h2>\n<table>\n<thead>\n<tr>\n<th>Thu\u1eadt ng\u1eef<\/th>\n<th>\u0110\u1eb7c tr\u01b0ng<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>LFI<\/td>\n<td>Quy\u1ec1n truy c\u1eadp t\u1ec7p c\u1ee5c b\u1ed9<\/td>\n<\/tr>\n<tr>\n<td>RFI<\/td>\n<td>Truy c\u1eadp t\u1eadp tin t\u1eeb xa<\/td>\n<\/tr>\n<tr>\n<td>Truy\u1ec1n t\u1ea3i th\u01b0 m\u1ee5c<\/td>\n<td>T\u01b0\u01a1ng t\u1ef1 nh\u01b0 LFI nh\u01b0ng ph\u1ea1m vi r\u1ed9ng h\u01a1n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h2>Quan \u0111i\u1ec3m v\u00e0 c\u00f4ng ngh\u1ec7 c\u1ee7a t\u01b0\u01a1ng lai li\u00ean quan \u0111\u1ebfn vi\u1ec7c \u0111\u01b0a t\u1ec7p c\u1ee5c b\u1ed9 v\u00e0o<\/h2>\n<ul>\n<li><strong>C\u01a1 ch\u1ebf b\u1ea3o m\u1eadt n\u00e2ng cao<\/strong>: C\u00e1c khu\u00f4n kh\u1ed5 v\u00e0 c\u00f4ng c\u1ee5 m\u1edbi \u0111\u1ec3 ng\u0103n ch\u1eb7n LFI.<\/li>\n<li><strong>Gi\u00e1m s\u00e1t d\u1ef1a tr\u00ean AI<\/strong>: S\u1eed d\u1ee5ng tr\u00ed tu\u1ec7 nh\u00e2n t\u1ea1o \u0111\u1ec3 ph\u00e1t hi\u1ec7n v\u00e0 ng\u0103n ch\u1eb7n c\u00e1c cu\u1ed9c t\u1ea5n c\u00f4ng LFI ti\u1ec1m \u1ea9n.<\/li>\n<li><strong>Khung ph\u00e1p l\u00fd<\/strong>: Nh\u1eefng t\u00e1c \u0111\u1ed9ng ph\u00e1p l\u00fd v\u00e0 quy \u0111\u1ecbnh c\u00f3 th\u1ec3 c\u00f3 \u0111\u1ec3 qu\u1ea3n l\u00fd an ninh m\u1ea1ng.<\/li>\n<\/ul>\n<h2>C\u00e1ch s\u1eed d\u1ee5ng ho\u1eb7c li\u00ean k\u1ebft m\u00e1y ch\u1ee7 proxy v\u1edbi t\u00ednh n\u0103ng bao g\u1ed3m t\u1ec7p c\u1ee5c b\u1ed9<\/h2>\n<p>C\u00e1c m\u00e1y ch\u1ee7 proxy nh\u01b0 OneProxy c\u00f3 th\u1ec3 \u0111\u01b0\u1ee3c s\u1eed d\u1ee5ng l\u00e0m l\u1edbp b\u1ea3o m\u1eadt \u0111\u1ec3 gi\u00e1m s\u00e1t v\u00e0 l\u1ecdc c\u00e1c y\u00eau c\u1ea7u c\u00f3 th\u1ec3 d\u1eabn \u0111\u1ebfn LFI. Th\u00f4ng qua c\u1ea5u h\u00ecnh, ghi nh\u1eadt k\u00fd v\u00e0 qu\u00e9t ph\u00f9 h\u1ee3p, m\u00e1y ch\u1ee7 proxy c\u00f3 th\u1ec3 b\u1ed5 sung th\u00eam m\u1ee9c \u0111\u1ed9 b\u1ea3o v\u1ec7 ch\u1ed1ng l\u1ea1i c\u00e1c l\u1ed7 h\u1ed5ng nh\u01b0 v\u1eady.<\/p>\n<h2>Li\u00ean k\u1ebft li\u00ean quan<\/h2>\n<ul>\n<li><a href=\"https:\/\/www.owasp.org\/index.php\/Testing_for_Local_File_Inclusion\" target=\"_new\" rel=\"noopener nofollow\">H\u01b0\u1edbng d\u1eabn OWASP v\u1ec1 LFI<\/a><\/li>\n<li><a href=\"https:\/\/cwe.mitre.org\/data\/definitions\/98.html\" target=\"_new\" rel=\"noopener nofollow\">B\u1ea3ng li\u1ec7t k\u00ea \u0111i\u1ec3m y\u1ebfu chung (CWE) cho LFI<\/a><\/li>\n<li><a href=\"https:\/\/oneproxy.pro\/vn\/\" target=\"_new\" rel=\"noopener\">D\u1ecbch v\u1ee5 b\u1ea3o m\u1eadt OneProxy<\/a><\/li>\n<\/ul>\n<p>(L\u01b0u \u00fd: Vui l\u00f2ng \u0111\u1ea3m b\u1ea3o r\u1eb1ng t\u1ea5t c\u1ea3 c\u00e1c li\u00ean k\u1ebft v\u00e0 th\u00f4ng tin \u0111\u1ec1u ph\u00f9 h\u1ee3p v\u1edbi c\u00e1c d\u1ecbch v\u1ee5 v\u00e0 ch\u00ednh s\u00e1ch c\u1ee7a OneProxy tr\u01b0\u1edbc khi xu\u1ea5t b\u1ea3n b\u00e0i vi\u1ebft.)<\/p>","protected":false},"featured_media":477857,"menu_order":0,"template":"","meta":{"_acf_changed":false,"content-type":"","inline_featured_image":false,"footnotes":""},"class_list":["post-477856","wiki","type-wiki","status-publish","has-post-thumbnail","hentry"],"acf":{"faq_title":"Frequently Asked Questions about <mark>Local File Inclusion: A Comprehensive Guide<\/mark>","faq_items":[{"question":"What is Local File Inclusion (LFI)?","answer":"<p>Local File Inclusion (LFI) is a security vulnerability that arises when an attacker manipulates input variables containing \"..\/\" sequences to access and include files not intended for public access. This flaw can lead to unauthorized file access and potential exploitation.<\/p>"},{"question":"How did Local File Inclusion (LFI) emerge?","answer":"<p>LFI gained attention in the early 2000s with the proliferation of dynamic web applications. Security experts began discussing this vulnerability on various forums and mailing lists as they identified risks associated with improper validation of user-supplied input.<\/p>"},{"question":"What are the main characteristics of Local File Inclusion (LFI)?","answer":"<p>The key features of LFI include the ability to manipulate file paths, potential escalation to remote file inclusion (RFI) or code execution, and its dependence on server configurations.<\/p>"},{"question":"What are the different types of Local File Inclusion (LFI)?","answer":"<p>LFI can manifest in various ways, including basic LFI where local files are directly accessed, LFI leading to RFI, and LFI exploited for code execution.<\/p>"},{"question":"How does Local File Inclusion (LFI) work?","answer":"<p>LFI occurs when a web application constructs a file path using user-supplied input, which is manipulated by the attacker. This leads to the inclusion of unintended files.<\/p>"},{"question":"What are the potential problems caused by Local File Inclusion (LFI)?","answer":"<p>LFI can result in unauthorized access to sensitive files, leakage of confidential information, and even system compromise if combined with code execution.<\/p>"},{"question":"How can Local File Inclusion (LFI) be prevented?","answer":"<p>To mitigate LFI risks, developers must implement proper input validation, adhere to secure coding practices, and conduct regular security audits.<\/p>"},{"question":"How can proxy servers like OneProxy be associated with Local File Inclusion (LFI)?","answer":"<p>Proxy servers, like OneProxy, can enhance security against LFI by monitoring and filtering requests that may lead to such vulnerabilities, adding an extra layer of protection to web applications.<\/p>"},{"question":"What does the future hold for Local File Inclusion (LFI) prevention?","answer":"<p>As technology evolves, we can expect advanced security mechanisms, AI-driven monitoring, and potential legal frameworks to address LFI risks and enhance web application security.<\/p>"}]},"_links":{"self":[{"href":"https:\/\/oneproxy.pro\/vn\/wp-json\/wp\/v2\/wiki\/477856","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/oneproxy.pro\/vn\/wp-json\/wp\/v2\/wiki"}],"about":[{"href":"https:\/\/oneproxy.pro\/vn\/wp-json\/wp\/v2\/types\/wiki"}],"version-history":[{"count":0,"href":"https:\/\/oneproxy.pro\/vn\/wp-json\/wp\/v2\/wiki\/477856\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/oneproxy.pro\/vn\/wp-json\/wp\/v2\/media\/477857"}],"wp:attachment":[{"href":"https:\/\/oneproxy.pro\/vn\/wp-json\/wp\/v2\/media?parent=477856"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}