skills.rest
salmanabdurrahman
salmanabdurrahmanCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

vuln-lfi-rfi

Validate LFI, RFI, and path traversal via canary files and encoding bypass tests.

Updated Jul 30, 2026
Search Tags:#security#vulnerability#pentest#lfi#rfi#path traversal
One-click install
npx skills add https://github.com/salmanabdurrahman/pi-pentest-agent --skill vuln-lfi-rfi
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: vuln-lfi-rfi
Source: https://github.com/salmanabdurrahman/pi-pentest-agent/tree/main/skills/vuln-lfi-rfi
Command: npx skills add https://github.com/salmanabdurrahman/pi-pentest-agent --skill vuln-lfi-rfi

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill provides a structured, authorized, and safe methodology for identifying and validating path traversal, local file inclusion (LFI), and remote file inclusion (RFI) vulnerabilities without risking system stability or data exposure.

Core Features & Use Cases

  • Safe Validation: Uses non-sensitive canary files to confirm traversal depth and file inclusion capabilities.
  • Bypass Testing: Systematically tests encoding variants and PHP stream wrappers to identify complex injection vectors.
  • Use Case: During a security assessment, use this skill to confirm if a file-path parameter is vulnerable to path traversal by attempting to read /etc/hostname, ensuring the process remains within defined scope and risk policies.

Quick Start

Use the vuln-lfi-rfi skill to test the file parameter on the target application for path traversal and file inclusion vulnerabilities.

Frequently Asked Questions about vuln-lfi-rfi

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I safely validate path traversal and local file inclusion vulnerabilities during a pentest?▼

To test for path traversal and local file inclusion safely, probe file-path parameters with non-sensitive canary files like /etc/hostname to confirm vulnerability depth without risking data exposure or system stability.

What is the best way to test encoding bypass variants for LFI and RFI vulnerabilities?▼

Systematically test encoding variants and PHP stream wrappers against file-path parameters to identify complex injection vectors and confirm local or remote file inclusion bypass capabilities.

Can I use non-sensitive canary files to confirm remote file inclusion without authorized scope?▼

No, you must maintain strict adherence to scope, authorization, and risk-gated execution policies when probing with canary files to prevent unauthorized data access or system modification.

When do I need to test PHP stream wrappers during a security assessment?▼

You need to test PHP stream wrappers when validating local file inclusion vulnerabilities to identify complex injection vectors that standard path traversal payloads might not uncover.

Why does my path traversal validation require risk-gated execution policies?▼

Risk-gated execution policies are required because probing file-path parameters and testing encoding bypasses can cause unauthorized data access or system modification if scope is exceeded.

What limitations exist when testing remote file inclusion with encoding bypass techniques?▼

Limitations include the strict requirement for authorized scope and risk-gated execution, as probing encoding bypasses and PHP stream wrappers risks unauthorized system modification if executed outside defined security assessment workflows.

Related Skills

Explore More Software Engineering Skills→
CENKSSSCENKSSS

pentest-validation

Validate SAST and DAST vulnerability exploitability through a 4-phase pipeline.

Community
Advanced
cybersecwomancybersecwoman
5

hunt-rce

Automate identification of Remote Code Execution vulnerabilities across various targets.

Community
Advanced
EntroVyxEntroVyx
3

web-enumeration

Scans web targets for exposed files, misconfigurations, and exploitable endpoints.

Community
Intermediate
rahmatullahbossrahmatullahboss

File Path Traversal Testing

Test web applications for directory traversal vulnerabilities using payloads and encoding bypasses.

Community
Intermediate