Detect and validate Local File Inclusion vulnerabilities via crafted URL payloads.
npx skills add https://github.com/0X6C7879/aegissec --skill exploit-lfi-0x6c7879
Please help me install this Agent Skill. Skill: exploit-lfi Source: https://github.com/0X6C7879/aegissec/tree/main/skills/exploit-lfi Command: npx skills add https://github.com/0X6C7879/aegissec --skill exploit-lfi-0x6c7879
This Skill automates the detection and exploitation workflow for Local File Inclusion (LFI) vulnerabilities, enabling security testers to quickly verify access to sensitive files and assess potential lateral movement vectors.
Target a URL with a vulnerable parameter and run traversal, wrapper, and poisoning payloads to begin testing.
High-intent search queries and answers about installing and using this skill.
Detect local file inclusion by injecting traversal payloads into URL parameters and analyzing HTTP responses for indicators like root:x:0:0: or [fonts]. This verifies unauthorized file access across Linux and Windows targets.
PHP wrapper protocols like php://filter can be used during LFI exploitation to read and transform file contents. This technique helps extract PHP code that would otherwise be executed rather than displayed.
Remote code execution from LFI can be explored through log poisoning, /proc/self/environ reads, and temporary file manipulation. These paths inject PHP code into files that the application then includes and executes.
Yes, LFI testing applies to web applications across both Linux and Windows targets. Payloads are categorized for traversal, encoding, null-byte, extension, and path confusion techniques to handle different operating system path structures.
Available LFI payload categories include traversal, encoding, null-byte, extension, path confusion, and mixed techniques. These bypass filters by manipulating file paths to access sensitive system files.
Yes, the requests library is required because the testing workflow issues HTTP requests to target URLs and parses the responses for file content and PHP code indicators to validate vulnerabilities.
giosuetedeschi-specIdentify and validate HTML injection vulnerabilities in web application inputs.
blacklanternsecurityExploits LFI and RFI vulnerabilities using PHP wrappers and path traversal.
carterwayneskhizeineSearch and manage SiYuan blocks and documents via HTTP POST JSON requests.
zebbernAutomate red-team reconnaissance and vulnerability discovery workflows.
