Exploits LFI and RFI vulnerabilities using PHP wrappers and path traversal.
npx skills add https://github.com/blacklanternsecurity/red-run --skill lfi
Please help me install this Agent Skill. Skill: lfi Source: https://github.com/blacklanternsecurity/red-run/tree/main/skills/web/lfi Command: npx skills add https://github.com/blacklanternsecurity/red-run --skill lfi
This Skill helps penetration testers identify and exploit Local File Inclusion (LFI) and Remote File Inclusion (RFI) vulnerabilities to access sensitive files and potentially achieve code execution.
php://filter, data://, and php://input for code execution and source code extraction./etc/passwd or even achieve remote code execution by poisoning log files.Use the lfi skill to attempt to read the file /etc/passwd from the target URL.
High-intent search queries and answers about installing and using this skill.
PHP wrappers like php://filter, data://, and php://input are used in file inclusion exploitation to extract source code and achieve remote code execution. This Skill leverages these wrappers to convert otherwise limited LFI vulnerabilities into direct code execution on the target server.
The best way to achieve remote code execution from an LFI vulnerability is through log poisoning or session file exploitation. This Skill automates injecting malicious code into accessible log files or session data and then including those files to trigger execution.
You bypass path traversal filters during file inclusion by applying various encoding and manipulation techniques to the targeted file path. This Skill handles multiple filter bypass strategies automatically, allowing you to reach restricted system files despite input sanitization.
Yes, you can use Remote File Inclusion (RFI) to execute code on misconfigured PHP servers by supplying a remote URL to a vulnerable parameter. This Skill identifies RFI flaws and leverages specific PHP configurations to run external code directly.
You should use PHP wrappers instead of standard path traversal when you need to extract raw source code or stream input directly, rather than just reading file contents. This Skill applies wrappers like php://filter to bypass execution and retrieve underlying application code.
utsavthakurAssess path traversal and local file inclusion vulnerabilities in PHP applications.
Junghyun99Audit codebases for hardcoded secrets, file exposure, and injection risks.
devtintTest file upload endpoints for security vulnerabilities with malicious payloads.
blacklanternsecurityExploit Jinja2 server-side template injection to achieve remote code execution.