RFI LFI

Welcome!. In this section we are going to learn what's LFI and RFI and we are going to solve some LFI challenges. In this section we need to know some interesting files that we can find in OS.

Linux interesting files.

These are some interesting files in linux, there are many more:

• /etc/passwd
• /etc/shadow
• /etc/group
• /etc/init.d/
• /etc/hostname
• /etc/network/interfaces
• /etc/profile
• ~/.ssh/
• ~/.bash_history
• /var/log/
• /var/log/apache2/access.log or /var/log/httpd/access.log

The most interesting files in this list are /etc/passwd and /etc/shadow, these are the one that we commonly look for in a pentest. Let's see what these files are. First, we need to understand the /etc/passwd, you can do it here here. And now the /etc/shadow here.

Windows interesting files.

Remember that Windows is also important.

• C:/Users/Administrator/NTUser.dat
• C:/Documents and Settings/Administrator/NTUser.dat
• C:/apache/logs/access.log
• C:/apache/logs/error.log
• C:/apache/php/php.ini

And many more. The one that we need to focus on is the NTUser.dat file you can find more info here.