Local File Inclusion (LFI)

GET /index.php?page=../../etc/passwd
If the app does not properly validate the page parameter, it may return the contents of /etc/passwd.

Common targets
System files (e.g., /etc/passwd, /etc/hosts)

Application configuration files

Log files that may contain credentials or session tokens

## How BlackLab helps
BlackLab’s LFI plugin detects and blocks these attempts by scanning for suspicious path patterns such as:

../ (directory traversal)

Absolute paths like /etc/passwd

Encoded traversal (..%2F)

Example configuration:

```ruby

BlackLab.configure do |config|
  config.plugins = [
    BlackLab::Plugins::LfiPlugin.new(weight: 2)
  ]
  config.callback_threshold = 3
end