domains / families / security / hunt-lfi

hunt-lfi

authentic

Hunt Local File Inclusion (LFI), Remote File Inclusion (RFI), and Path Traversal — /etc/passwd read, log poisoning → RCE, PHP filter-chain RCE (no upload needed), php:// / data:// / zip:// / phar:// wrappers, RFI via allow_url_include, directory traversal read/write/delete. Covers OOB/blind LFI confirmation and false-positive discipline. Use when hunting file-include or path-traversal bugs on any target.

When to use

• LFI hunting
• RFI hunting
• Path Traversal
• PHP filter-chain RCE
• Log poisoning
• OOB/blind LFI confirmation
• Directory traversal read/write/delete

When not to use

• Tasks not involving file-include or path-traversal bugs

Skill page

Source