HTTP File Inclusion Fuzzing

Scan GET parameters for injection points that accept file paths or URLs.

If parameter hits, expect larger response sizes or error leaks indicating path traversal. Chain to fuzz common LFI paths next.

Fuzz Common LFI Paths

Target known sensitive files on Linux/Windows.

Valid hits show file contents in response; filter false positives by baseline size. Use output to confirm OS type from file paths.

Fuzz PHP File Names

Hunt for injectable PHP endpoints.

Hits return 200 OK with PHP-processed content. Prioritize for parameter injection testing.

Fuzz Webroot Paths

Probe for base directory to chain with relative paths.

Successful paths expose root configs; use to build absolute paths for deeper LFI.

Fuzz Log and Config Files

Target app-specific logs/configs.

Hits leak logs with user agents or errors; parse for creds or env vars to pivot to auth bypass or RCE.

Automated LFI Scanning

Clone and run LFISuite for auto-fuzzing paths, wrappers, and bypasses.

Feed it the vulnerable URL and param. Output lists readable files; ignore if no traversal. Use results to select exploitation targets.