hunt-lfi

To exploit LFI and path traversal, you identify misconfigured file access parameters and test payloads to read sensitive files. This Skill provides methodical detection across common parameter patterns to validate read-side exposure.

Yes, you can use PHP wrappers like php:// and phar:// to escalate local file inclusion to remote code execution. This Skill demonstrates chain templates and bypass techniques for RCE impact verification.

Bypassing path traversal filters with double encoding involves altering payload characters to evade input validation. This Skill covers bypass techniques including double encoding and log-based payloads for successful exploitation.

Log poisoning works by injecting malicious code into server logs and then including that log file via an LFI vector to trigger execution. This Skill provides chain templates and real-world workflows for validating these RCE chains.

You verify RCE impacts by applying safe payloads to file access parameters and executing chain templates against test targets. This Skill supports detection, bypass techniques, and verification steps to confirm remote code execution.

No specific dependencies are required to detect RFI and archive-based inclusion vectors. This Skill operates independently to identify remote file inclusion and archive-based vectors during web application security testing.