lfi-traversal

Detect LFI and path traversal vulnerabilities by probing parameters with payloads.

Updated Apr 21, 2026

Search Tags:#security #vulnerability assessment #web application #path traversal #local file inclusion

Ready to run

npx skills add https://github.com/jayjpatel9717/kurukshetra --skill lfi-traversal

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: lfi-traversal
Source: https://github.com/jayjpatel9717/kurukshetra/tree/main/squads/pentest/agents/abhimanyu/skills/lfi-traversal
Command: npx skills add https://github.com/jayjpatel9717/kurukshetra --skill lfi-traversal

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires curl, python3, and includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill automates the detection and prevention of Local File Inclusion (LFI) and Path Traversal vulnerabilities in web applications, enhancing application security.

Core Features & Use Cases

LFI Detection: Identifies file inclusion vulnerabilities where user inputs are used to access local files.
Path Traversal Detection: Discovers path traversal vulnerabilities that allow attackers to access unauthorized directories.
Detection-First Approach: Focuses on detection without exploitation to prevent sensitive data exposure.
Methodology: Utilizes a structured approach including parameter identification, path traversal testing, encoding variants, and PHP wrapper checks.

Quick Start

Use the lfi-traversal skill to detect Local File Inclusion (LFI) in the 'showimage.php' endpoint on the target domain.

Frequently Asked Questions about lfi-traversal

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I detect Local File Inclusion and path traversal vulnerabilities in web applications?▼

To detect Local File Inclusion and path traversal vulnerabilities, you probe file inclusion parameters with various payloads to identify security weaknesses. This detection-first approach assesses a system's attack surface without actively exploiting the endpoints.

What payloads are used to test for path traversal in a web application security assessment?▼

Path traversal testing utilizes payloads including parameter identification, encoding variants, and PHP wrapper checks. These structured probes systematically test user inputs to discover unauthorized directory access points in the attack surface.

Do I need curl and python3 to test for LFI vulnerabilities?▼

Yes, you need curl and python3 to test for LFI vulnerabilities. Curl handles external requests to the target web application, while the lfi_probe.py script manages the local testing logic for the security assessment.

Can I use automated scripts to check for PHP wrappers during file inclusion testing?▼

Yes, automated scripts can check for PHP wrappers during file inclusion testing. The methodology applies parameter identification, encoding variants, and wrapper checks to systematically identify potential security weaknesses in user inputs.

Does LFI detection exploit the vulnerable endpoints it finds?▼

No, LFI detection does not exploit the vulnerable endpoints it finds. This detection-first approach focuses on identifying potential file inclusion and path traversal points without exploitation to prevent sensitive data exposure.