What are LFI and RFI (Local / Remote File Inclusion) attacks?

Short answer

File Inclusion attacks rely on steering, with user input, the mechanism with which the application loads a file at runtime and includes it in its code (CWE-98). LFI (Local File Inclusion) gets a local file on the server (configuration, log, password file) included; RFI (Remote File Inclusion) aims to get a remote file under the attacker's control included and to run code on the server. In TR7 WAF, the File Inclusion category (34 rules) of the built-in Signature & Rule Library catches these attempts, and the Directory/Path Traversal category catches the ../ sequences that LFI relies on; matching requests appear in WAF Event Logs with these categories in the Category field.

Where It Is Used in TR7

Where	Field / label	What for
Configuration Menu → WAF → Signature & Rule Library; the OWASP Rules screen of the vService	The Signature Category column (hidden by default); Filter → Signature Categories → File Inclusion	Listing the rules in the category; changing their state or score
WAF Event Logs and Global WAF Event Log	The Category column (hidden by default), the Category tab in the filter strip, the Category row on the Summary and Attacks tabs of the record preview	Seeing that the request was caught by a signature in this category
WAF Dashboard	The Detected Attacks by Category panel	The density of the detections in the category over time
WAF report	The Classification view	The category breakdown in the report

• The signatures of the category work in the path, query, form, header, JSON, XML and raw body; the CWE (mostly CWE-98) and CAPEC mappings of a rule are seen on the Classification tab in the preview: How do I see which OWASP Top 10, CWE, CAPEC and MITRE ATT&CK entries a rule maps to?
• All the category names and rule counts: Which attack categories do the signatures cover?

Common Misconceptions

• "LFI and path traversal are the same." Path traversal reads the file outside the directory; LFI gets the file included in the code the application runs and can lead to code execution. In TR7, they are tracked in two separate categories: What is a Directory / Path Traversal attack?
• "RFI is seen only in old applications." There is a risk in every application whose file inclusion mechanism is open to user input; the permanent measure is selecting the file to be included not from the input but from a fixed allow list.
• "WAF signatures close the vulnerability in the application." The signatures catch known patterns at the request level; the vulnerability is closed in the application.

How it is done in the documentation

• Signature & Rule Library · Signature Categories
• Event Logs · The Filterable Information
• Dashboard · Detected Attacks by Category

Related questions

• What is a Directory / Path Traversal attack?
• Which attack categories do the signatures cover?
• What is OS Command Injection?