Connected to target host (127.0.0.1:80)
Apache/2.4.41 (Ubuntu 22.04) PHP/7.4.3
LFI Exploitation Guide & Cheat Sheet
Essential Local File Inclusion payloads & path traversal mechanics
What is Local File Inclusion (LFI)?
Local File Inclusion occurs when a web application takes user input (such as ?page=filename) and passes it directly to file inclusion functions like PHP's include() or require() without sanitization. An attacker can use directory traversal sequences (../ or ..\) to read sensitive system files outside the web directory.
Critical Linux Targets
/etc/passwd
User accounts list
proc/self/environ
Process environment & DB keys
var/log/apache2/access.log
Web server logs (Log Poisoning target)
Critical Windows Targets
Windows\win.ini
System configuration file
Users\Administrator\Desktop\passwords.txt
Admin credentials
xampp\htdocs\web.config
IIS / Server configuration
Advanced Technique: PHP Filter Wrapper
When PHP files (config.php) contain executable code, inclusion normally executes them instead of displaying raw source code. Using the Base64 filter wrapper encodes the source before execution: