菜单
Local File Inclusion / path traversal → read files, sometimes RCE. Load when a param names a file/path/template/page: ?file=, ?page=, ?template=, ?download=, ?lang=, or path segments. Signals: filenames in params, "include", download endpoints, `../` filtered, `.php?page=`.
默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。
决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/NoorQureshi/SploitAgent --skill web-lfi-path-traversal命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
正在显示 SKILL.md
Attack Active Directory Certificate Services (ADCS) — ESC1–ESC8 template/CA misconfigurations to escalate to Domain Admin. Load with a domain foothold/creds where ADCS is present, on "certipy", "ESC1", "certificate template", or a CA server. Signals: Cert Publishers, pKIEnrollmentService, ports 443/135 on a CA, certipy find output.
Abuse Active Directory object ACLs/DACLs for lateral movement and escalation — GenericAll, WriteDACL, GenericWrite, WriteOwner, AddMember, ForceChangePassword, and DCSync rights. Load with domain creds + BloodHound showing an ACL edge, on "GenericAll", "WriteDACL", "DCSync", "abuse this edge".
Kerberoasting & AS-REP roasting — request/crack Kerberos tickets to recover service/user passwords offline. Load with any domain foothold or valid domain creds, on "kerberoast", "AS-REP", SPNs, service accounts, ports 88/389. Signals: domain creds in hand, SPNs set, accounts with pre-auth disabled.
| name | web-lfi-path-traversal |
| description | Local File Inclusion / path traversal → read files, sometimes RCE. Load when a param names a file/path/template/page: ?file=, ?page=, ?template=, ?download=, ?lang=, or path segments. Signals: filenames in params, "include", download endpoints, `../` filtered, `.php?page=`. |
| domain | web |
| type | technique |
| stability | learning |
| modes | ["pentest","bugbounty"] |
| severity | high |
| owasp | ["A01:2021-Broken-Access-Control"] |
| cwe | ["CWE-22","CWE-98"] |
| tools | ["burp","ffuf"] |
| schema_version | 1 |
A parameter or path segment controls which file the server reads/includes. Path traversal reads arbitrary files; LFI (include) can execute them → RCE.
The app builds a filesystem path from user input without normalizing/constraining it, so ../
sequences escape the intended directory. If the value is included (PHP), included content is executed.
?file=/etc/passwd, then traversal ?file=../../../../etc/passwd; on
Windows ..\..\..\windows\win.ini...%2f, double ..%252f, ....// (strip-once), overlong
%c0%af, null %00 (old PHP), absolute paths, nested .....php://filter/convert.base64-encode/resource=index.php
(read source), data:///expect://, and log poisoning (write PHP into a log via
User-Agent, then include the log) or session//proc/self/environ inclusion for RCE.ffuf a LFI wordlist.include $p.".php") blocks arbitrary read → try wrappers or null byte (old PHP).php://filter to find the next bug faster.Contents of a file outside the intended directory returned (e.g. /etc/passwd, app config/
source), or code execution via a wrapper/log-poisoning include.
PortSwigger path-traversal labs; LFI-to-RCE cheat sheets; OWASP path traversal.