LFI to impact
Path traversal that reads a file you can name is a primitive. It becomes RCE or secret theft when the include, log, or upload lands in an executable context.
Playbooks
- LFI to RCE - File read is P3-P4. Wrappers, log poison, session files, and upload + include are how it becomes RCE.
Payloads
- LFI / Path Traversal - Read local files, then escalate. PHP wrappers turn LFI into source disclosure or RCE (log poisoning, php://filter chains). Later entries defeat filters via encoding and traversal padding.
- Path normalization - Proxy vs app disagreements. 403 bypass, cache deception, and /static vs /account mapping.
Bypasses
- LFI / path-traversal bypass - Read files when naive traversal is filtered, then escalate. PHP filter chains are the modern, upload-free path to RCE; null-byte truncation is legacy (flagged below).
Tools
- gf - A wrapper around grep with reusable pattern packs (xss, sqli, ssrf, lfi, redirect). Instantly slices URL lists into likely-vulnerable candidates.
Questions
Is /etc/passwd the report?
It proves the primitive. The report is the next hop: source code, env, session storage, or log include.
Wrappers?
php://filter, zip://, and encoding tricks are bypasses. Use them on an owned file name, not a spray.
This page is the public form of hunt_brief("lfi") on the MCP connector. Authorized testing only.