Agent skill · security · yaklang
path-traversal-lfi
Path traversal and LFI playbook. Use when file paths, download endpoints, include operations, archive extraction, or wrapper behavior may expose filesystem control.
Why this skill is useful
Adds detailed attack sequences and techniques for path traversal and LFI exploitation that are not commonly known or documented.
What it needs
About 10k tokens when loaded. Last updated 2026-06-16. 1,563 stars on the source repository.
What this skill does
SKILL: Path Traversal / Local File Inclusion (LFI) — Expert Attack Playbook AI LOAD INSTRUCTION: Expert path traversal and LFI techniques. Covers encoding bypass sequences, OS differences, filter bypass, PHP wrapper exploitation, log poisoning to RCE, and the critical distinction between path traversal (read only) vs LFI (execution). Base models miss encoding chains and RCE escalation paths. 0. RELATED ROUTING Before deep exploitation, you can first load: upload insecure files when the primary attack surface is an upload workflow rather than an include or read primitive ghost-bits-cast-attack when the target is a Java backend (Spring, Jetty, Undertow, Vert.x) and standard ../, %2e%2e, %252e chains are WAF-blocked — Ghost Bits substitutes . with 阮 (U+962E) and / with 阯 (U+962F), re-enabling traversal through Spring CVE-2025-41242 and Jetty %2> hex-folding First-pass traversal chains --- 1. CORE CONCEPT Path Traversal: Read arbitrary files by escaping the intended directory with ../ sequences. LFI: In PHP, when user input controls include()/require() — file is executed as PHP code, not just read. --- 2. TRAVERSAL SEQUENCE VARIANTS The filtering strategy determines which encoding to use: Basic URL Encoding Double URL Encoding (when server decodes once, filter checks before decode) Unicode / Overlong UTF-8 Mixed Encodings Filter Strips ../ (so ../ becomes ../ after strip) Null Byte Injection (legacy PHP < 5.3.4) --- 3. TARGET FILES AND ESCALATION TARGETS Linux Web Application Config Files Windows --- 4. PHP LFI → RCE TECHNIQUES Log Poisoning (most reliable when log is accessible) Step 1: Inject PHP code into Apache/Nginx access log via User-Agent: Step 2: Include the log file via LFI: SSH Log Poisoning Inject PHP payload as SSH username: Then include /var/log/auth.log. PHP Session File Poisoning Step 1: Send PHP code in session-stored parameter (e.g., username), triggering storage in session file Step 2: Include session file: Find session ID from cookie PHPSESSID. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills yaklang/path-traversal-lfi