Payloads.site / Payload Guides / LFI

Local File Inclusion (LFI) Payloads & Techniques

Local file inclusion (LFI) arises when user input controls a filename or path passed into a file-inclusion or file-read function without proper sanitization. Depending on the application, this can let an attacker read arbitrary local files, leak configuration or credentials, or — in some configurations, via log or session poisoning — achieve code execution.

Common Traversal Patterns

../../../../etc/passwd
..%2f..%2f..%2fetc%2fpasswd
....//....//....//etc/passwd
php://filter/convert.base64-encode/resource=index.php
..\..\..\..\windows\win.ini

Encoding & Filter Considerations

Naive traversal filters are often bypassed with URL-encoding or double-encoding of path separators, nested traversal sequences that survive a single-pass string replacement (e.g. ....//), null-byte truncation on legacy PHP versions, and wrapper schemes such as php:// or file:// that read or transform file contents instead of a plain path. LFI is also closely related to remote file inclusion, which targets the same vulnerable include/require call but with a remote source.

These patterns illustrate the underlying technique only — see the full, searchable payload library and encoder for a larger, regularly updated set of traversal and wrapper variations.

Further reading: PortSwigger – Path traversal

Open the full LFI Payload Library & Encoder →