HTTP File Inclusion Fuzzing

Scan GET parameters for injection points that accept file paths or URLs. Parameters named file, page, path, lang, include, or template are high-value targets. The -fs value filters responses that match the baseline size. Measure your baseline first by sending a request with a dummy parameter value and recording the response size. Adjust -fs to match that number. Parameters returning a larger or noticeably different response are injection candidates worth pursuing. Confirmed injection points move to LFI exploitation or RFI exploitation.

• Parameter discovery fuzzes common parameter names against the target to find file-loading inputs.
• LFI path fuzzing tests traversal variants against /etc/passwd and win.ini with dedicated wordlists.
• PHP file hunting discovers injectable PHP endpoints using directory wordlists.
• Webroot path probing identifies the server's base directory to calibrate traversal depth.
• Log and config file targeting reads application logs and .env files for credentials and log poisoning targets.

If a parameter accepts file paths, expect larger responses or PHP error messages. Errors like "failed to open stream" confirm the application passes input directly to a file-open function. PHP warnings often leak the full server path, which is a free path disclosure. Record any absolute paths exposed in errors before moving on. A size difference of even a few hundred bytes against the baseline is a reliable indicator. Chain to the LFI paths wordlist once you have a confirmed parameter.

Fuzz Common LFI Paths

Target known sensitive files on Linux and Windows. On Linux, /etc/passwd is the fastest confirmation target. On Windows, C:\Windows\win.ini serves the same purpose. Use a dedicated LFI wordlist rather than a generic path discovery list. LFI-Jhaddix.txt covers both OS families and includes traversal depth variations to handle different include root configurations.

Valid hits show file contents in the response body. Filter false positives by comparing against the baseline size set with -fs. A response containing "root:x:0:0" confirms Linux. One containing "[extensions]" or "; for 16-bit app support" confirms Windows. The OS confirmation drives your wordlist choices for subsequent requests. Look for /etc/passwd entries with /bin/bash or /bin/sh shells to identify interactive user accounts worth targeting later.

Fuzz PHP File Names

Hunt for injectable PHP endpoints. These are files that dynamically include other files based on user input. Even a file that returns 200 without visible LFI output may be injectable through a different parameter. Run this scan in parallel with LFI path fuzzing to build a complete picture of the attack surface.

Hits return 200 with PHP-processed content, not raw source code. Prioritize discovered files for parameter injection testing. Files in non-standard directories or with generic names often have weaker input handling. For each hit, test common LFI parameter names against it. A file that processes arbitrary includes is a direct path to confirmed LFI.

Fuzz Webroot Paths

Probe the base directory to chain with relative traversal strings. The number of ../ sequences required depends on webroot depth relative to the filesystem root. This command tests common Linux webroot locations to find which one resolves. Knowing the exact webroot path lets you build precise traversal strings without guessing traversal depth.

Successful paths expose the webroot location and confirm your traversal depth. If /var/www/html resolves, your traversal string from that directory is fixed. Adjust the ../ count in subsequent requests accordingly. Once the webroot is known, configuration files like .env, config.php, or database.yml are immediate targets for credential extraction.

Fuzz Log and Config Files

Target application-specific log and configuration files. Log files often expose credentials, internal paths, and environment variables. Apache access logs and PHP error logs are standard targets. If you can read the access log, you can attempt log poisoning by injecting a PHP payload into your User-Agent header, then including the log to trigger execution.

Log hits often contain raw HTTP request data including User-Agent strings you control. Parse the response for database credentials, API keys, or session tokens in environment files. If the log is readable and you control a logged field, inject a PHP payload into it and include the log file to trigger remote code execution. This LFI-to-RCE path applies to Apache, Nginx, and PHP-FPM logs equally. Environment files like .env expose database credentials and application secrets directly without needing code execution.

Automated LFI Scanning

Clone and run LFISuite for automatic fuzzing of paths, PHP wrappers, and filter bypasses. This tool covers null byte injection, path truncation, double encoding, and wrapper techniques in one pass. LFISuite requires Python 2, which is not installed by default on modern Kali. Use it after manually confirming a vulnerable parameter to map the full attack surface quickly.

Feed it the vulnerable URL and the parameter name. Output lists all confirmed readable files on the target. If no traversal fires, the tool reports nothing useful. Return to manual testing if output is empty. Use the confirmed file list to select exploitation targets. If PHP wrappers work, pivot to php://filter for base64-encoded source disclosure or php://input to attempt remote code execution.