Detect Local File Inclusion / Remote File Inclusion (LFI/RFI)

Anoozilla HunterX@AnoozillaHunterX

•updated Jul 14, 2025•3•0•77

This rule detects attempts at Local File Inclusion (LFI) or Remote File Inclusion (RFI) vulnerabilities by analyzing web server logs for specific patterns in the request URI. It looks for directory traversal sequences ('../'), attempts to access common sensitive files like '/etc/passwd', or patterns indicating file inclusion via HTTP or file:// protocols.