lfi

What problem does it solve?

This Skill helps penetration testers identify and exploit Local File Inclusion (LFI) and Remote File Inclusion (RFI) vulnerabilities to access sensitive files and potentially achieve code execution.

Core Features & Use Cases

• LFI/RFI Identification: Detects and attempts to exploit file inclusion flaws.
• Traversal & Bypass: Handles various path traversal techniques and bypasses for common filters.
• PHP Wrapper Exploitation: Leverages php://filter, data://, and php://input for code execution and source code extraction.
• Log Poisoning & Session Exploitation: Utilizes log files and session data for LFI to RCE.
• Use Case: When a web application parameter is found to be vulnerable to LFI, this Skill can be used to read sensitive configuration files like /etc/passwd or even achieve remote code execution by poisoning log files.

Quick Start

Use the lfi skill to attempt to read the file /etc/passwd from the target URL.