path-traversal-lfi

An expert attack playbook for path traversal and Local File Inclusion (LFI), used when file paths, download endpoints, include operations, archive extraction, or wrapper behavior may expose filesystem control. It draws a sharp line between path traversal, reading arbitrary files by escaping the intended directory with ../ sequences, and LFI, where in PHP user input reaches include() or require() and the target file is executed as code rather than merely read. That distinction drives which escalation paths are available.

It catalogs traversal sequence variants tuned to the server's filtering strategy: basic ../ chains, Linux and Windows paths, single and double URL encoding (%2e/%252e), overlong UTF-8 and fullwidth Unicode, mixed encodings, redundant sequences like ....// that survive a single strip, and legacy null-byte injection. A reference section lists high-value target files, including /etc/passwd, /etc/shadow, /proc/self/environ, SSH keys, .bash_history, cloud credentials, and web-app config files such as .env and wp-config.php on Linux, plus hosts, SAM, and web.config on Windows.

For PHP it details LFI-to-RCE techniques: log poisoning via a PHP payload in the User-Agent then including the access log, SSH auth-log poisoning, PHP session-file poisoning, and the expect://, php://input, and data:// wrappers. It also covers using php://filter with base64 or other converters (including chained filters) to exfiltrate source code, Remote File Inclusion when allow_url_include is on, historical path-truncation tricks, a list of parameter names to test (file, page, include, path, and many more), and a filter-bypass checklist. For WAF-blocked Java backends it routes to a Ghost Bits skill, and for upload-centric surfaces to an upload skill. Use it during web application penetration testing whenever a parameter appears to influence which file the server opens, includes, or serves.