Path traversal lfi rfi testing

Path Traversal Lfi Rfi Testing

penkit51 AI — professional penetration testing skill pack. Authorized testing only.

Deep Exploitation Guide

Path Traversal / LFI / RFI

Improper file path handling and dynamic inclusion enable sensitive file disclosure, config/source leakage, SSRF pivots, and code execution. Treat all user-influenced paths, names, and schemes as untrusted; normalize and bind them to an allowlist or eliminate user control entirely.

Attack Surface

Path Traversal

• Read files outside intended roots via ../, encoding, normalization gaps

Local File Inclusion (LFI)

• Include server-side files into interpreters/templates

Remote File Inclusion (RFI)

• Include remote resources (HTTP/FTP/wrappers) for code execution

Archive Extraction

• Zip Slip: write outside target directory upon unzip/untar

Normalization Mismatches

• Server/proxy differences (nginx alias/root, upstream decoders)
• OS-specific paths: Windows separators, device names, UNC, NT paths, alternate data streams

High-Value Targets

Unix

• /etc/passwd, /etc/hosts, application .env/config.yaml
• SSH keys, cloud creds, service configs/logs

Windows

• C:\Windows\win.ini, IIS/web.config, programdata configs, application logs

Application

• Source code templates and server-side includes
• Secrets in env dumps, framework caches

Reconnaissance

Surface Map

• HTTP params: file, path, template, include, page, view, download, export, report, log, dir, theme, lang
• Upload and conversion pipelines: image/PDF renderers, thumbnailers, office converters
• Archive extract endpoints and background jobs; imports with ZIP/TAR/GZ/7z
• Server-side template rendering (PHP/Smarty/Twig/Blade), email templates, CMS themes/plugins
• Reverse proxies and static file servers (nginx, CDN) in front of app handlers

Capability Probes

• Path traversal baseline: ../../etc/hosts and C:\Windows\win.ini
• Encodings: %2e%2e%2f, %252e%252e%252f, ..%2f, ..%5c, mixed UTF-8 (%c0%2e), Unicode dots and slashes
• Normalization tests: ..../, ..\\, ././, trailing dot/double dot segments; repeated decoding
• Absolute path acceptance: /etc/passwd, C:\Windows\System32\drivers\etc\hosts
• Server mismatch: /static/..;/../etc/passwd ("..;"), encoded slashes (%2F), double-decoding via upstream

Detection Channels

Direct

• Response body discloses file content (text, binary, base64)
• Error pages echo real paths

Error-Based

• Exception messages expose canonicalized paths or include() warnings with real filesystem locations

OAST

• RFI/LFI with wrappers that trigger outbound fetches (HTTP/DNS) to confirm inclusion/execution

Side Effects

• Archive extraction writes files unexpectedly outside target
• Verify with directory listings or follow-up reads

Key Vulnerabilities

Path Traversal Bypasses

Encodings

• Single/double URL-encoding, mixed case, overlong UTF-8, UTF-16, path normalization oddities

Mixed Separators

• / and \\ on Windows; // and \\\\ collapse differences across frameworks

Dot Tricks

• ....// (double dot folding), trailing dots (Windows), trailing slashes, appended valid extension

Absolute Path Injection

• Bypass joins by supplying a rooted path

Alias/Root Mismatch

• nginx alias without trailing slash with nested location allows ../ to escape
• Try /static/../etc/passwd and ";" variants (..;)

Upstream vs Backend Decoding

• Proxies/CDNs decoding %2f differently; test double-decoding and encoded dots

LFI Wrappers and Techniques

PHP Wrappers

• php://filter/convert.base64-encode/resource=index.php (read source)
• zip://archive.zip#file.txt
• data://text/plain;base64
• expect:// (if enabled)

Log/Session Poisoning

• Inject PHP/templating payloads into access/error logs or session files then include them

Upload Temp Names

• Include temporary upload files before relocation; race with scanners

Proc and Caches

• /proc/self/environ and framework-specific caches for readable secrets

Legacy Tricks

• Null-byte (%00) truncation in older stacks; path length truncation

Template Engines

• PHP include/require; Smarty/Twig/Blade with dynamic template names
• Java/JSP/FreeMarker/Velocity; Node.js ejs/handlebars/pug engines
• Seek dynamic template resolution from user input (theme/lang/template)

RFI Conditions

Requirements

• Remote includes (allow_url_include/allow_url_fopen in PHP)
• Custom fetchers that eval/execute retrieved content
• SSRF-to-exec bridges

Protocol Handlers

• http, https, ftp; language-specific stream handlers

Exploitation

• Host a minimal payload that proves code execution
• Prefer OAST beacons or deterministic output over heavy shells
• Chain with upload or log poisoning when remote includes are disabled

Archive Extraction (Zip Slip)

• Files within archives containing ../ or absolute paths escape target extract directory
• Test multiple formats: zip/tar/tgz/7z
• Verify symlink handling and path canonicalization prior to write
• Impact: overwrite config/templates or drop webshells into served directories

Testing Methodology

1. Inventory file operations - Downloads, previews, templates, logs, exports/imports, report engines, uploads, archive extractors
2. Identify input joins - Path joins (base + user), include/require/template loads, resource fetchers, archive extract destinations
3. Probe normalization - Separators, encodings, double-decodes, case, trailing dots/slashes
4. Compare behaviors - Web server vs application behavior
5. Escalate - From disclosure (read) to influence (write/extract/include), then to execution (wrapper/engine chains)

Validation

1. Show a minimal traversal read proving out-of-root access (e.g., /etc/hosts) with a same-endpoint in-root control
2. For LFI, demonstrate inclusion of a benign local file or harmless wrapper output (php://filter base64 of index.php)
3. For RFI, prove remote fetch by OAST or controlled output; avoid destructive payloads
4. For Zip Slip, create an archive with ../ entries and show write outside target (e.g., marker file read back)
5. Provide before/after file paths, exact requests, and content hashes/lengths for reproducibility

False Positives

• In-app virtual paths that do not map to filesystem; content comes from safe stores (DB/object storage)
• Canonicalized paths constrained to an allowlist/root after normalization
• Wrappers disabled and includes using constant templates only
• Archive extractors that sanitize paths and enforce destination directories

Impact

• Sensitive configuration/source disclosure → credential and key compromise
• Code execution via inclusion of attacker-controlled content or overwritten templates
• Persistence via dropped files in served directories; lateral movement via revealed secrets
• Supply-chain impact when report/template engines execute attacker-influenced files

Pro Tips

1. Compare content-length/ETag when content is masked; read small canonical files (hosts) to avoid noise
2. Test proxy/CDN and app separately; decoding/normalization order differs, especially for %2f and %2e encodings
3. For LFI, prefer php://filter base64 probes over destructive payloads; enumerate readable logs and sessions
4. Validate extraction code with synthetic archives; include symlinks and deep ../ chains
5. Use minimal PoCs and hard evidence (hashes, paths). Avoid noisy DoS against filesystems

Summary

Eliminate user-controlled paths where possible. Otherwise, resolve to canonical paths and enforce allowlists, forbid remote schemes, and lock down interpreters and extractors. Normalize consistently at the boundary closest to IO.

Platform Methodology

Path Traversal Lfi Rfi Testing

penkit51 AI — professional penetration testing skill pack. Authorized testing only.

Deep Exploitation Guide

Path Traversal / LFI / RFI

Improper file path handling and dynamic inclusion enable sensitive file disclosure, config/source leakage, SSRF pivots, and code execution. Treat all user-influenced paths, names, and schemes as untrusted; normalize and bind them to an allowlist or eliminate user control entirely.

Attack Surface

Path Traversal

• Read files outside intended roots via ../, encoding, normalization gaps

Local File Inclusion (LFI)

• Include server-side files into interpreters/templates

Remote File Inclusion (RFI)

• Include remote resources (HTTP/FTP/wrappers) for code execution

Archive Extraction

• Zip Slip: write outside target directory upon unzip/untar

Normalization Mismatches

• Server/proxy differences (nginx alias/root, upstream decoders)
• OS-specific paths: Windows separators, device names, UNC, NT paths, alternate data streams

High-Value Targets

Unix

• /etc/passwd, /etc/hosts, application .env/config.yaml
• SSH keys, cloud creds, service configs/logs

Windows

• C:\Windows\win.ini, IIS/web.config, programdata configs, application logs

Application

• Source code templates and server-side includes
• Secrets in env dumps, framework caches

Reconnaissance

Surface Map

• HTTP params: file, path, template, include, page, view, download, export, report, log, dir, theme, lang
• Upload and conversion pipelines: image/PDF renderers, thumbnailers, office converters
• Archive extract endpoints and background jobs; imports with ZIP/TAR/GZ/7z
• Server-side template rendering (PHP/Smarty/Twig/Blade), email templates, CMS themes/plugins
• Reverse proxies and static file servers (nginx, CDN) in front of app handlers

Capability Probes

• Path traversal baseline: ../../etc/hosts and C:\Windows\win.ini
• Encodings: %2e%2e%2f, %252e%252e%252f, ..%2f, ..%5c, mixed UTF-8 (%c0%2e), Unicode dots and slashes
• Normalization tests: ..../, ..\\, ././, trailing dot/double dot segments; repeated decoding
• Absolute path acceptance: /etc/passwd, C:\Windows\System32\drivers\etc\hosts
• Server mismatch: /static/..;/../etc/passwd ("..;"), encoded slashes (%2F), double-decoding via upstream

Detection Channels

Direct

• Response body discloses file content (text, binary, base64)
• Error pages echo real paths

Error-Based

• Exception messages expose canonicalized paths or include() warnings with real filesystem locations

OAST

• RFI/LFI with wrappers that trigger outbound fetches (HTTP/DNS) to confirm inclusion/execution

Side Effects

• Archive extraction writes files unexpectedly outside target
• Verify with directory listings or follow-up reads

Key Vulnerabilities

Path Traversal Bypasses

Encodings

• Single/double URL-encoding, mixed case, overlong UTF-8, UTF-16, path normalization oddities

Mixed Separators

• / and \\ on Windows; // and \\\\ collapse differences across frameworks

Dot Tricks

• ....// (double dot folding), trailing dots (Windows), trailing slashes, appended valid extension

Absolute Path Injection

• Bypass joins by supplying a rooted path

Alias/Root Mismatch

• nginx alias without trailing slash with nested location allows ../ to escape
• Try /static/../etc/passwd and ";" variants (..;)

Upstream vs Backend Decoding

• Proxies/CDNs decoding %2f differently; test double-decoding and encoded dots

LFI Wrappers and Techniques

PHP Wrappers

• php://filter/convert.base64-encode/resource=index.php (read source)
• zip://archive.zip#file.txt
• data://text/plain;base64
• expect:// (if enabled)

Log/Session Poisoning

• Inject PHP/templating payloads into access/error logs or session files then include them

Upload Temp Names

• Include temporary upload files before relocation; race with scanners

Proc and Caches

• /proc/self/environ and framework-specific caches for readable secrets

Legacy Tricks

• Null-byte (%00) truncation in older stacks; path length truncation

Template Engines

• PHP include/require; Smarty/Twig/Blade with dynamic template names
• Java/JSP/FreeMarker/Velocity; Node.js ejs/handlebars/pug engines
• Seek dynamic template resolution from user input (theme/lang/template)

RFI Conditions

Requirements

• Remote includes (allow_url_include/allow_url_fopen in PHP)
• Custom fetchers that eval/execute retrieved content
• SSRF-to-exec bridges

Protocol Handlers

• http, https, ftp; language-specific stream handlers

Exploitation

• Host a minimal payload that proves code execution
• Prefer OAST beacons or deterministic output over heavy shells
• Chain with upload or log poisoning when remote includes are disabled

Archive Extraction (Zip Slip)

• Files within archives containing ../ or absolute paths escape target extract directory
• Test multiple formats: zip/tar/tgz/7z
• Verify symlink handling and path canonicalization prior to write
• Impact: overwrite config/templates or drop webshells into served directories

Testing Methodology

1. Inventory file operations - Downloads, previews, templates, logs, exports/imports, report engines, uploads, archive extractors
2. Identify input joins - Path joins (base + user), include/require/template loads, resource fetchers, archive extract destinations
3. Probe normalization - Separators, encodings, double-decodes, case, trailing dots/slashes
4. Compare behaviors - Web server vs application behavior
5. Escalate - From disclosure (read) to influence (write/extract/include), then to execution (wrapper/engine chains)

Validation

1. Show a minimal traversal read proving out-of-root access (e.g., /etc/hosts) with a same-endpoint in-root control
2. For LFI, demonstrate inclusion of a benign local file or harmless wrapper output (php://filter base64 of index.php)
3. For RFI, prove remote fetch by OAST or controlled output; avoid destructive payloads
4. For Zip Slip, create an archive with ../ entries and show write outside target (e.g., marker file read back)
5. Provide before/after file paths, exact requests, and content hashes/lengths for reproducibility

False Positives

• In-app virtual paths that do not map to filesystem; content comes from safe stores (DB/object storage)
• Canonicalized paths constrained to an allowlist/root after normalization
• Wrappers disabled and includes using constant templates only
• Archive extractors that sanitize paths and enforce destination directories

Impact

• Sensitive configuration/source disclosure → credential and key compromise
• Code execution via inclusion of attacker-controlled content or overwritten templates
• Persistence via dropped files in served directories; lateral movement via revealed secrets
• Supply-chain impact when report/template engines execute attacker-influenced files

Pro Tips

1. Compare content-length/ETag when content is masked; read small canonical files (hosts) to avoid noise
2. Test proxy/CDN and app separately; decoding/normalization order differs, especially for %2f and %2e encodings
3. For LFI, prefer php://filter base64 probes over destructive payloads; enumerate readable logs and sessions
4. Validate extraction code with synthetic archives; include symlinks and deep ../ chains
5. Use minimal PoCs and hard evidence (hashes, paths). Avoid noisy DoS against filesystems

Summary

Eliminate user-controlled paths where possible. Otherwise, resolve to canonical paths and enforce allowlists, forbid remote schemes, and lock down interpreters and extractors. Normalize consistently at the boundary closest to IO.

Validation & Reporting

• Confirm every finding with reproducible PoC before reporting
• Document: severity (CVSS), affected asset, steps, evidence, remediation
• Use record_vulnerability when running inside the penkit51 platform
• Chain low-severity findings into higher-impact attack paths
• Never report without evidence — distinguish hypothesis from confirmed vuln

Validation & Reporting

• Confirm every finding with reproducible PoC before reporting
• Document: severity (CVSS), affected asset, steps, evidence, remediation
• Use record_vulnerability when running inside the penkit51 platform
• Chain low-severity findings into higher-impact attack paths
• Never report without evidence — distinguish hypothesis from confirmed vuln