skills.rest
EntroVyx
EntroVyxCOMMUNITY
Explore all skills by this author →
GitHub

hunt-lfi

Identify and exploit LFI, RFI, and path traversal vulnerabilities in web applications.

3|1|Updated Jul 2, 2026
Search Tags:#web-security#pentesting#rce#lfi#rfi#path-traversal
One-click install
npx skills add https://github.com/EntroVyx/hermes-agent-offsec --skill hunt-lfi-entrovyx
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunt-lfi
Source: https://github.com/EntroVyx/hermes-agent-offsec/tree/main/skills/offsec/redteam/hunt-lfi
Command: npx skills add https://github.com/EntroVyx/hermes-agent-offsec --skill hunt-lfi-entrovyx

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill addresses the difficulty of identifying and confirming complex file inclusion vulnerabilities, helping hunters move beyond simple path traversal to achieve reliable, high-impact exploitation.

Core Features & Use Cases

  • Advanced Exploitation: Provides methodologies for modern techniques like PHP filter-chain RCE, log poisoning, and wrapper-based source disclosure.
  • Validation Discipline: Offers a rigorous framework to distinguish between false positives and genuine vulnerabilities using OOB confirmation and differential analysis.
  • Use Case: When testing a web application, use this skill to systematically evaluate URL parameters for LFI, confirm findings with Burp Collaborator, and escalate to RCE using advanced PHP filter-chain techniques.

Quick Start

Use the hunt-lfi skill to identify potential file inclusion vulnerabilities on the target domain and validate them using the provided OOB confirmation methodology.

Frequently Asked Questions about hunt-lfi

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I exploit Local File Inclusion to get Remote Code Execution?▼

Local File Inclusion vulnerabilities can be escalated to Remote Code Execution using advanced techniques like PHP filter-chain RCE and log poisoning. This skill provides methodologies for wrapper-based source disclosure to systematically achieve reliable code execution.

What is the best way to test URL parameters for RFI and Path Traversal?▼

Systematic parameter analysis evaluates URL parameters for Remote File Inclusion and Path Traversal vulnerabilities. This skill identifies potential entry points and validates them using a rigorous framework to ensure high-confidence reporting of filesystem access.

Do I need Burp Collaborator to verify LFI and Path Traversal findings?▼

Burp Collaborator is used for blind OOB confirmation of file inclusion vulnerabilities when the application lacks visible output. While not strictly required, it provides a rigorous validation framework to distinguish false positives from genuine Path Traversal and LFI findings.

Why are my Path Traversal attempts returning false positives during web pentesting?▼

Path Traversal attempts often return false positives without rigorous validation discipline. This skill provides a framework using OOB confirmation and differential analysis to distinguish between false positives and genuine filesystem access vulnerabilities.

Related Skills

Explore More Software Engineering Skills→
jayjpatel9717jayjpatel9717

lfi-traversal

Detect LFI and path traversal vulnerabilities by probing parameters with payloads.

Community
Intermediate
zebbernzebbern
34

File Path Traversal Testing

Identifies and exploits file path traversal vulnerabilities in web applications.

Community
Advanced
jokken79jokken79
1

Burp Suite Web Application Testing

Intercept, modify, and analyze HTTP traffic to identify web application vulnerabilities.

Community
Advanced
cxnaivecxnaive

web-pentest

Perform authorized web application penetration testing with reconnaissance, vulnerability analysis, and proof-based exploitation.

Community
Advanced