Let's take a look at the following code that will exploit LFI/RFI vulnerabilities in DVWA:
In the following code snippet, lines 65-74 check whether the application to be tested requires authentication for the vulnerability to be exploited:
If authentication is required, then the cookie values supplied from the user are set at a Selenium Python browser/driver, and the URL is invoked with cookie data to have a valid session:
The lines between 90 and 105 are used to control the LFI vulnerability workflow. This section has ...
