File Inclusion, Upload, and Path Traversal Exploitation
Inclusion, upload, and traversal
File inclusion tests whether user input reaches include, require, or template loaders. LFI: use php://filter/convert.base64-encode/resource=index.php to read source, php://input or data:// when allow_url_include is on, log poisoning, /proc/self/environ, and session files. Path traversal: ../, URL-encoded %2e%2e%2f, double encoding, absolute paths, and normalization quirks. Upload: test extension handling (.php, .php5, .phtml, .phar), Content-Type, magic bytes, .htaccess, polyglots, filename traversal, and race conditions between validation and move.
Worked example
page=../../../../etc/passwd returns the file, confirming traversal. Requesting page=php://filter/convert.base64-encode/resource=index.php returns Base64 source, revealing an upload directory /uploads and a weak check that only inspects the Content-Type. Upload shell.jpg containing GIF89a plus <?php system($_GET['c']); ?> with Content-Type: image/jpeg; if the server renames to .jpg, try .phtml or a .htaccess that maps .jpg to PHP. The reasoning is to confirm read, then find a write primitive and an execution path.
Traps
Stopping after one encoding; assuming traversal is blocked because ../ is stripped; uploading without confirming the web root executes; forgetting that LFI needs a sink to become RCE; missing that phar:// requires a file operation.