skills.rest
langbyyi
langbyyiCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

path-traversal-lfi

Detect and exploit path traversal and LFI vulnerabilities in web applications.

96|1|Updated Jun 4, 2026
Search Tags:#web-security#penetration-testing#lfi#vulnerability-assessment#path-traversal#rce-escalation#php-exploitation
One-click install
npx skills add https://github.com/langbyyi/CyberStrikeAI-SRC --skill path-traversal-lfi-langbyyi
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: path-traversal-lfi
Source: https://github.com/langbyyi/CyberStrikeAI-SRC/tree/main/skills/path-traversal-lfi
Command: npx skills add https://github.com/langbyyi/CyberStrikeAI-SRC --skill path-traversal-lfi-langbyyi

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill addresses the common web application vulnerability of path traversal and local file inclusion (LFI), which allows unauthorized access to sensitive server files or arbitrary code execution via manipulated user-controlled file path inputs, eliminating manual effort for identifying and exploiting these flaw types.

Core Features & Use Cases

  • Comprehensive Technique Library: Covers encoding bypass methods (URL, double URL, Unicode overlong), OS-specific path variations for Linux and Windows, filter bypass strategies, and PHP wrapper exploitation for both read-only traversal and code execution via LFI.
  • RCE Escalation Guidance: Includes proven, step-by-step methods to escalate low-severity path traversal findings to full remote code execution via log poisoning, session file manipulation, php://input/data wrapper abuse, and PEARCMD exploitation.
  • Use Case: A penetration tester assessing a customer's web application can use this Skill to quickly identify vulnerable file inclusion parameters, extract sensitive credentials from server configuration files, and validate whether the application is susceptible to LFI-to-RCE attack chains.

Quick Start

Use the path-traversal-lfi skill to test the target web application's file path input parameter for path traversal vulnerabilities and identify viable remote code execution escalation paths.

Frequently Asked Questions about path-traversal-lfi

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I test for path traversal and LFI vulnerabilities in web applications?▼

Testing for path traversal and LFI involves manipulating user-controlled file path parameters to detect unauthorized filesystem access, applying encoding bypass methods and OS-specific path variations to extract sensitive server files.

What is the best way to escalate local file inclusion to remote code execution?▼

The best way to escalate LFI to remote code execution uses log poisoning, session file manipulation, php://input or data wrapper abuse, and PEARCMD exploitation to achieve arbitrary code execution through the file inclusion vector.

How do PHP wrappers work for LFI exploitation?▼

PHP wrappers work for LFI exploitation by using protocols like php://input and data:// to convert a local file inclusion vulnerability into arbitrary code execution, or php://filter to read source code via encoded streams.

Can I use encoding bypass techniques to access files on both Linux and Windows servers?▼

Yes, encoding bypass techniques like URL, double URL, and Unicode overlong encoding apply to both Linux and Windows servers, with OS-specific path variations used to enumerate and access target files on each respective operating system.

What filter bypass strategies exist for path traversal when input sanitization is applied?▼

Filter bypass strategies for path traversal include encoding variations, nested path sequences, and truncation techniques designed to circumvent common input sanitization filters applied to user-controlled file path parameters.

When should I use LFI to RCE attack chains during a penetration testing engagement?▼

You should use LFI to RCE attack chains during authorized penetration testing engagements when a low-severity file inclusion finding needs validation for full remote code execution impact via log poisoning or PHP wrapper exploitation.

Related Skills

Explore More Software Engineering Skills→
utsavthakurutsavthakur

path-traversal-lfi

Assess path traversal and local file inclusion vulnerabilities in PHP applications.

Community
Advanced
AeonDaveAeonDave
15

lazagne

Extract saved passwords from browsers, mail clients, databases, Git, and WiFi.

Community
Intermediate
NickCrewNickCrew
29

owasp-top-10

Identify OWASP Top 10 security vulnerabilities in web applications.

Community
Advanced
rahmatullahbossrahmatullahboss

File Path Traversal Testing

Test web applications for directory traversal vulnerabilities using payloads and encoding bypasses.

Community
Intermediate