Web Penetration Testing with Kali Linux - Third Edition

File inclusion attacks

At the design level, the application should minimize the user input that would affect the flow of the application. If the application relies on user input for file inclusion, choose indirect references rather than direct ones. For example, the client submits an object ID that is then searched for in a server-side catalog that contains the list of valid files to include. Code reviews should be done to watch out for functions that are including files, and checks should be performed to analyze whether proper input validation is done to sanitize the data received from the user.