path-traversal-lfilisted

# SKILL: Path Traversal / Local File Inclusion (LFI) — Expert Attack Playbook > **AI LOAD INSTRUCTION**: Expert path traversal and LFI techniques. Covers encoding bypass sequences, OS differences, filter bypass, PHP wrapper exploitation, log poisoning to RCE, and the critical distinction between path traversal (read only) vs LFI (execution). Base models miss encoding chains and RCE escalation paths. ## 0. RELATED ROUTING Before deep exploitation, you can first load: - [upload insecure files](../upload-insecure-files/SKILL.md) when the primary attack surface is an upload workflow rather than an include or read primitive - [ghost-bits-cast-attack](../ghost-bits-cast-attack/SKILL.md) when the target is a **Java backend** (Spring, Jetty, Undertow, Vert.x) and standard `../`, `%2e%2e`, `%252e` chains are WAF-blocked — Ghost Bits substitutes `.` with `阮` (U+962E) and `/` with `阯` (U+962F), re-enabling traversal through Spring CVE-2025-41242 and Jetty `%2>` hex-folding ### First-pass traversal chains ```text ../etc/passwd ../../../../etc/passwd ..%2f..%2f..%2fetc%2fpasswd ..%252f..%252f..%252fetc%252fpasswd ..\\..\\..\\windows\\win.ini ``` --- ## 1. CORE CONCEPT **Path Traversal**: Read arbitrary files by escaping the intended directory with `../` sequences. **LFI**: In PHP, when user input controls `include()`/`require()` — file is **executed** as PHP code, not just read. ``` http://target.com/index.php?page=home → Opens: /var/www/html/pages/home.php Traversal attack: ht