What it is
Anywhere a filename or a path reaches the filesystem, the question is whether you can steer it. Include a local file, include a remote one, or upload something the server is willing to execute - all three come from the same trust mistake.
How I attack it
- Find the parameter that names a file, then walk upwards and see where the app stops you.
- If a prefix or suffix is added, work with it: known directories, null bytes on old stacks, encoding tricks against a weak filter.
- For uploads, separate the three checks - extension, content type and content - and defeat them one at a time.
- Know what you want to read before you start: configs, credentials, source, and on Linux /proc for the quick wins.
Learn it from The XSS Rat