New to this? Try a free practice lab — a scripted hacking challenge in your browser, no account needed.
What you'll do
As an attacker, the two main goals in exploiting LFI are typically to expose secret or sensitive information or to cause arbitrary code to be executed, giving them remote command execution.
For the former goal, you may want the source code for the application, which is made difficult in that the code is interpreted and executed and not directly displayed.
For the latter goal, one of the main hurdles is getting your own code onto the server itself in order to be included by the application.
We will deal with both of these issues in this lab.
