LFI to impact
Path traversal that reads a file you can name is a primitive. It becomes RCE or secret theft when the include, log, or upload lands in an executable context.
Skill
No skill is linked for this class yet. Start with the playbook on this page.
Practice the class in the browser: PortSwigger Web Security Academy. The lab is theirs. This page is the stop condition and the disclosures.
Checklists
None linked for this class yet.
Disclosures
No public card yet.
Playbooks
- LFI to RCE - File read is P3-P4. Wrappers, log poison, session files, and upload + include are how it becomes RCE.
Payloads
- LFI / Path Traversal - Read local files, then escalate. PHP wrappers turn LFI into source disclosure or RCE (log poisoning, php://filter chains). Later entries defeat filters via encoding and traversal padding.
Bypasses
- LFI / path-traversal bypass - Read files when naive traversal is filtered, then escalate. PHP filter chains are the modern, upload-free path to RCE; null-byte truncation is legacy (flagged below).
Questions
Is /etc/passwd the report?
It proves the primitive. The report is the next hop: source code, env, session storage, or log include.
Wrappers?
php://filter, zip://, and encoding tricks are bypasses. Use them on an owned file name, not a spray.
This page is the linked pack hunt_brief("lfi") returns on the MCP connector. Authorized testing only.