Payloads.
Pick a vulnerability class, learn how to hunt it step by step, grab the payloads that actually work. Curated from PayloadsAllTheThings — the full section is linked under every class.
File Inclusion (LFI)
Including files the application never intended — most common in PHP — escalating from /etc/passwd reads to code execution. It's path traversal plus evaluation: the included file's contents get executed as code.
Severity guide
Critical when RFI/code execution works; high on proven arbitrary file reads; wrappers (php://filter) that leak source count as high too.
Where to look
entry points to test first01
Page/template parameters
?page=, ?file=, ?path=, ?template=, ?view= — anything that ends up inside include()/require().
02
Language/locale pickers
?lang=en loads en.php — the classic legacy PHP pattern.
03
Theme/plugin loaders
CMS components resolving modules by name from user input.
04
Download/serve endpoints
Streamed files where the server opens a path built from your input — often RFI-adjacent.
05
Session/state includes
Anything including per-user files (sessions, caches, uploads) with a user-controlled name.
How to hunt it
in order, start to finishFind file-path parameters
?page=, ?file=, ?path=, template/view/include params. Anything that ends up inside include(), require() or a filesystem call.
Read the canary
../../../etc/passwd — a known, readable file that confirms traversal without damaging anything.
Bypass filters
Filtered? Try double-encoding (%252e%252e%252f), overlong UTF-8 (%c0%ae), or ....//....// which collapses when ../ is stripped once.
Try the PHP wrappers
php://filter/convert.base64-encode/resource=index.php leaks source code as base64 — a different, often unblocked wrapper. php://input and data:// become direct code-execution vectors when allow_url_include is on.
Escalate to code execution
Log poisoning (inject PHP into access logs, include the log), session files, uploaded-file paths, or /proc/self/environ — each can turn LFI into RCE.
Filter & validation bypasses
when your first tries get blocked- 01Traversal stripped once? ....//....// re-forms ../ after the strip pass.
- 02Single URL-decode only? Double-encode: %252e%252e%252f.
- 03Extension appended (.php forced)? Null byte %00 truncates on PHP < 5.3.4; or point at paths that are already .php (logs, sessions).
- 04Prefix prepended? Climb depth to exit the base dir, or use absolute paths when include allows them.
Impact ladder
what makes it payable- 01Source-code disclosure — php://filter leaks application secrets (DB creds, API keys).
- 02Credential/session theft — read /etc/shadow, session stores, config files.
- 03Log poisoning → RCE — inject code into logs, include them, execute.
- 04Full compromise when RFI is possible (rare but critical).
Payloads
6 · from PayloadsAllTheThingshttp://example.com/index.php?page=../../../etc/passwdThe canary read — confirms path traversal into include().
http://example.com/index.php?page=php://filter/convert.base64-encode/resource=indexPHP wrapper — leaks the page's source code as base64.
http://example.com/index.php?page=%252e%252e%252fetc%252fpasswdDouble URL-encoding — defeats single-pass decode filters.
http://example.com/index.php?page=%c0%ae%c0%ae/%c0%ae%c0%ae/etc/passwdOverlong UTF-8 encoding — classic PHP filter bypass.
http://example.com/index.php?page=....//....//etc/passwdFilter stripper bypass — the stripping of ../ re-forms it from ....//
http://example.com/index.php?page=../../../etc/passwd%00Null-byte truncation (PHP < 5.3) to drop an appended .php extension.
Payload strings, code and technical terms are shown in English on purpose — payloads must be copied exactly as published.
Payloads originate from PayloadsAllTheThings (MIT) — use them only on programs you're authorized to test.