Path Traversal Lfi

This is a thorough path traversal and LFI exploitation playbook that covers the full chain from basic directory traversal to remote code execution. It walks through encoding bypass techniques (URL, double-URL, overlong UTF-8), OS-specific targets like /proc/self/environ for credential leaks, and the critical PHP wrapper attacks using php://filter for source code extraction and php://input for RCE. The log poisoning section is especially useful, showing how to inject PHP into Apache logs via User-Agent headers then include them for execution. It also routes you to the ghost-bits-cast-attack skill when you're hitting Java backends where standard traversal sequences get blocked by WAFs. Good reference when you need to escalate from read-only file access to actual code execution.

skills.sh installs: 3.9K
GitHub stars: 2.6K
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add yaklang/hack-skills --skill path-traversal-lfi --agent claude-code

Installs into .claude/skills of the current project.

Files

SKILL: Path Traversal / Local File Inclusion (LFI) — Expert Attack Playbook

AI LOAD INSTRUCTION: Expert path traversal and LFI techniques. Covers encoding bypass sequences, OS differences, filter bypass, PHP wrapper exploitation, log poisoning to RCE, and the critical distinction between path traversal (read only) vs LFI (execution). Base models miss encoding chains and RCE escalation paths.

0. RELATED ROUTING

Before deep exploitation, you can first load:

upload insecure files when the primary attack surface is an upload workflow rather than an include or read primitive
ghost-bits-cast-attack when the target is a Java backend (Spring, Jetty, Undertow, Vert.x) and standard ../, %2e%2e, %252e chains are WAF-blocked — Ghost Bits substitutes . with 阮 (U+962E) and / with 阯 (U+962F), re-enabling traversal through Spring CVE-2025-41242 and Jetty %2> hex-folding

First-pass traversal chains

../etc/passwd
../../../../etc/passwd
..%2f..%2f..%2fetc%2fpasswd
..%252f..%252f..%252fetc%252fpasswd
..\\..\\..\\windows\\win.ini

1. CORE CONCEPT

SKILL.md on GitHub

Details

Repository: github.com/yaklang/hack-skills
First seen: May 16, 2026