---
title: "Intro to File Inclusions | Hack The Box Academy"
source: "https://academy.hackthebox.com/app/module/23/section/250"
domain: "academy.hackthebox.com"
type: "article"
summarized_at: "2026-08-30"
canonical: "https://tl-dr.cc/s/intro-to-file-inclusions-hack-the-box-academy-N4fv"
---

# Intro to File Inclusions | Hack The Box Academy

**Source:** [academy.hackthebox.com](https://academy.hackthebox.com/app/module/23/section/250)  
**Summarized:** 2026-08-30  

- Local File Inclusion (LFI) vulnerabilities allow attackers to manipulate HTTP parameters to read or execute arbitrary files on a server, potentially exposing source code, credentials, and enabling remote code execution.
- LFI occurs when web applications use unsanitized user input in file-loading functions like PHP's include(), NodeJS's fs.readFile(), Java's include, or .NET's Response.WriteFile().
- Some functions only read file content (safe for execution) while others execute files as code; PHP include() and .NET include execute, while file_get_contents() and fs.readFile() only read.
- File inclusion vulnerabilities span multiple frameworks and languages (PHP, NodeJS, Java, .NET) and are typically exploited through parameters like ?language= or URL path segments.
- Even read-only LFI is critical because leaked source code may reveal database credentials, admin keys, or additional vulnerabilities for further exploitation.

---
*AI summary by [tl;dr](https://tl-dr.cc) · [View full page](https://tl-dr.cc/s/intro-to-file-inclusions-hack-the-box-academy-N4fv)*