How I Uncovered a Local file inclusion Vulnerability on Website

As a security researcher, I constantly test websites for flaws that hackers might use against them. A Local File Inclusion (LFI) flaw that could let an attacker access private files and data on the website's server was found by me during a recent examination of the XYZ website.

What is an LFI vulnerability?

A particular kind of online application vulnerability known as an LFI vulnerability enables an attacker to embed files from the web server on a user-requested page. Attackers can exploit this to access private data and files that shouldn't be made available to the general public.

How to identify a website's LFI vulnerability

I'm trying out the target.com website. as I navigate to the subsequent page, I note that the URL is target/index.php?page=hem.php.

Now i try to change the directory, so i add some simple LFI payloads 

 ../../../etc/passwd

but the payload is not worked 

I tried other encoded payloads, but they didn't work. 

after some try, I found the right payload.

the payload is

..//..//..//..//..//..//..//etc//shadow

  

WOW😁 Now you can see the shadow file.

"I hope this blog post has been informative and helpful. Remember, website security is everyone's responsibility!"

HAPPY HACKING!