Detect, validate, and exploit LFI, RFI, and path traversal vulnerabilities.
npx skills add https://github.com/uphiago/recon-skills --skill hunt-lfi-uphiago
Please help me install this Agent Skill. Skill: hunt-lfi Source: https://github.com/uphiago/recon-skills/tree/main/redteam/hunt-lfi Command: npx skills add https://github.com/uphiago/recon-skills --skill hunt-lfi-uphiago
Manual testing for local file inclusion (LFI), remote file inclusion (RFI), and path traversal vulnerabilities is time-consuming, error-prone, and often misses high-impact exploitation paths like PHP filter-chain RCE that require no file uploads. This Skill eliminates false positives with strict validation rules and provides an end-to-end workflow to find, confirm, and exploit these flaws across common web stacks.
Use the hunt-lfi skill to test the ?file= parameter on your target web application for local file inclusion vulnerabilities, confirm any blind findings with out-of-band callbacks, and escalate to remote code execution if the target supports PHP filter wrappers.
High-intent search queries and answers about installing and using this skill.
You can exploit LFI to achieve remote code execution using PHP filter chains by applying iconv-based filter sequences that require no file uploads or writable directories. This technique manipulates PHP wrappers to convert a simple file-read primitive into full RCE.
Confirm blind path traversal vulnerabilities using out-of-band callbacks and timing differentials. By injecting payloads that trigger external interactions, you validate blind inclusion flaws with strict, false-positive-free confirmation rules.
Yes, you can test for RFI and path traversal across PHP, Java, Node.js, Windows/IIS, and Python/Flask environments. The process applies stack-specific payloads and target files to accurately detect reflected and blind inclusion flaws across these platforms.
The best way to bypass WAF rules during local file inclusion testing is to apply a comprehensive bypass table for common input filters. This approach maps specific WAF restrictions to effective alternative payloads, ensuring successful exploitation during penetration testing.
You should use log poisoning for LFI exploitation when you need to escalate a local file inclusion vulnerability but lack writable file paths or PHP filter support. It injects malicious code into server logs and includes those logs to trigger execution.
jayjpatel9717Detect LFI and path traversal vulnerabilities by probing parameters with payloads.
AeonDaveAutomate LFI vulnerability testing and exploitation to achieve remote code execution.
SnailSploitTest file upload vulnerabilities using Burp Suite, ExifTool, and custom scripts.
cmndcntrlcyberIdentify and demonstrate file upload security bypass techniques in web applications.
