Local File Inclusion Vulnerability Explained (with a bit of pentesting)

This post is a hands-on walkthrough of exploiting a PHP Local File Inclusion (LFI) vulnerability on a PWNLab VM: the author uses vulnerability scanning and php://filter to read source files and database credentials, logs in to the application, bypasses image upload whitelists by prepending "GIF89;" to a PHP reverse shell renamed with a .gif extension, uploads the shell, and triggers execution via a cookie-based include to obtain a remote shell and then attempts local privilege escalation.