Hello, everyone, and welcome to this video.
So in this video, we are going to learn about one of the most important vulnerability, which is known
as viral inclusion.
But before starting file inclusion types of attacks, we need to distinguish between a unique vulnerability,
which is sometimes confused with file inclusion, which is known as part traversal.
All right.
So let's jump into this and see what this actually is.
The first question that should arise to your mind is why file inclusion?
Does these types of one's abilities really hold that much of importance then set?
Is this high value target if you are able to identify any final conclusion and to those, for example,
Uber, PayPal, Google, Facebook, etc., then this vulnerability.
Has the CBO scored, which lies in the range of high to critical, so what actually is final inclusion?
So this vulnerability exist when any Web application includes a file without correctly sanitizing the
input, which allows the attacker to manipulate the input and inject part traversal characters and include
other files from the Web server, which basically means you need to identify an injection point and
you need to include any file from the server.
And if the server gives you that particular file, then, yes, you have successfully identified a file
inclusion based vulnerabilities abilities now to make the situations more worse, you can include some
of the sensitive files from the server, which will hold a lot of security and make the book critical.
All right, so I have demonstrated a diagram over here in which you can see on the left hand side is
the attacker.
On the right hand side is the server, which may be one labeled two part traversal or file inclusion.
So the first thing that will happen over here is the attacker is going to send a request to the server
and in return, the server is going to reply with a response.
Now, in part, traversal based vulnerability's attacker is able to read one of the file from the server.
For instance, if the given server is running onto a Linux based operating systems, then the attacker
is able to read that possibility or the ADC shadow file.
And if the system is running on a Windows based computer, then the attacker can read the log file or
the Butut any file.
All right.
Now, to understand this mode and to get a clear picture of what is the difference between part traversal
and file inclusion, you can see this figure in which you can see there are two circles, the outer
circle and the inner circle.
The Outer Circle represents file inclusion.
The inner circle represents, which is a subset part traversal.
So this basically means file inclusion based vulnerability's is the combination of parts traversal plus
execute files, which basically means in file inclusion.
You're able to read the files from any server and also you're able to execute files as well.
And if able to execute the files, then you have found a valid file, inclusion based vulnerability.
So I hope this is clear with everyone.
And you know, now that that the bot traversal is a subset of file inclusion and file inclusion, you
can also execute the files onto the server in the next video.
So we are going to see how you can demonstrate a file inclusion and part traversal like vulnerabilities
onto any given server.
Thank you.