skills.rest
inventashif
inventashifCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

hunt-lfi

Detects and exploits LFI, RFI, and path traversal vulnerabilities during authorized bug bounty testing.

Updated Sep 6, 2026
Search Tags:#penetration testing#web security#rce#lfi#path traversal#bug bounty#php wrappers
One-click install
npx skills add https://github.com/inventashif/helpful-code-sidekick --skill hunt-lfi-inventashif
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunt-lfi
Source: https://github.com/inventashif/helpful-code-sidekick/tree/main/scripts/hackerai/skills/bughunter/hunt-lfi
Command: npx skills add https://github.com/inventashif/helpful-code-sidekick --skill hunt-lfi-inventashif

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Security researchers often miss or misreport Local File Inclusion and path traversal bugs because blind sinks produce no visible output and filter bypasses are easy to get wrong. This Skill provides a structured methodology to find, confirm, and escalate file-inclusion vulnerabilities without false positives. ## Core Features & Use Cases - Systematic Detection Workflow: Enumerate candidate parameters (page, file, template, path), apply traversal and encoding bypasses, and test PHP wrappers like php://filter for source disclosure. - Escalation Chains to RCE: Upgrade a file-read primitive via PHP filter-chain iconv conversion, log poisoning, session/upload poisoning, phar:// deserialization, or RFI when allow_url_include is enabled. - Blind Confirmation Discipline: Use Burp Collaborator OOB callbacks and triple-confirmed timing/length deltas to prove blind LFI, avoiding false positives from echoed paths or status-code diffs. - Use Case: While testing a PHP target, you find ?page= accepts input. Follow the methodology to read /etc/passwd, leak index.php source via base64 filter, then build a filter-chain payload to achieve command execution with OOB proof. ## Quick Start Ask the AI to hunt for LFI and path traversal vulnerabilities on your authorized target using the hunt-lfi methodology, starting with parameter enumeration and /etc/passwd confirmation.

Frequently Asked Questions about hunt-lfi

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test for LFI vulnerabilities in a web application?▼

Identify parameters like page, file, path, or template, then submit traversal payloads such as ../../../etc/passwd with encoding variants. Confirm a real read only when actual file contents appear, such as a root:x:0:0 line, not an echoed path or error message.

How to escalate LFI to remote code execution without file upload?▼

Use the PHP filter-chain technique, which chains iconv conversions inside php://filter to forge an arbitrary PHP payload in memory. Generate the chain with Synacktiv's php_filter_chain_generator and pass it to the include sink to execute commands without any upload endpoint.

How do I confirm a blind LFI with no visible output?▼

Use a php://filter or RFI payload that triggers a DNS and HTTP callback to a unique Burp Collaborator subdomain, proving the include executed. Alternatively, triple-confirm a stable timing or response-length delta between existing and non-existent files.

Does RFI work on modern PHP configurations?▼

RFI requires allow_url_include and allow_url_fopen enabled, which are off by default on modern PHP. It still appears on legacy or misconfigured hosts; confirm by pointing the include at a Collaborator URL and watching for a server-side callback.

Why is my path traversal payload blocked by the filter?▼

Filters often strip ../ once or decode input once, so use ....// sequences, double URL-encoding like %252f, or encoded dots %2e%2e%2f. If the app appends .php, truncate with a trailing ? or #, or use a null byte on PHP versions below 5.3.4.

What severity should I report for an LFI finding?▼

Non-sensitive file reads are Medium, reads exposing database credentials, API keys, or private keys are High, and any chain achieving code execution via filter-chain, RFI, log poisoning, session, or phar is Critical. Always show controlled command output or an OOB callback as RCE proof.

Related Skills

Explore More Software Engineering Skills→
hanc00lhanc00l

reconnaissance

Performs penetration testing reconnaissance by scanning ports, identifying stacks, and crawling web content.

Community
Intermediate
kaminocorpkaminocorp
1

Vulnerability Report Writing

Generate bounty-ready vulnerability reports with CVSS scoring and evidence-based severity calibration.

Official
Intermediate
SnailSploitSnailSploit
2.9k

xxe

Identify, test, and exploit XML External Entity injection vulnerabilities.

Community
Advanced
dmbs335dmbs335
18

fuzzer-wordlist-generator

Generate fuzzing wordlists and mutation seeds from vulnerability taxonomy documents.

Community
Advanced