Traversal Basics

There is no allow_local_include. No PHP release deprecated ... No default configuration stops include('../../../../etc/passwd'), and none ever will, because reaching a file by relative path is what relative paths are for.

That is the reason this guide, rather than Classic RFI, describes what you will actually be doing. The remote variant needs a configuration from 2006. This needs a sink and a parameter.

You are almost never told what happened. Learn the failure shapes:

What you see	What it means
The file contents	Traversal works, sink reads or the file has no PHP tags
A blank page where content used to be	Often success — the file was executed rather than printed. Try a file with no PHP tags
failed to open stream: No such file	Path resolution reached somewhere real but wrong. Adjust depth or spelling
failed to open stream: Permission denied	The path resolved and the worker cannot read it. The traversal works; pick a different target
open_basedir restriction in effect	Confirmed traversal, confined. See open_basedir
Identical response to a garbage path	Either a fallback default, or your input is not reaching the sink at all
500 with no body	Suppressed errors. Move to timing or out-of-band confirmation

The second row is the one that wastes the most time. A blank response to ?page=../config.php looks like failure and is frequently a total success — include() executed the file, and a config file that only assigns variables produces no output. Point it at /etc/passwd to confirm the traversal, then use php://filter to read the source you actually wanted.

Padding makes depth mostly irrelevant. When it is not — because something normalises the path before checking it, or a filter caps the number of ../ — you can measure instead.

Read the error. failed to open stream messages usually contain the fully resolved path. One request tells you the base directory and therefore the exact depth. This is the fastest method by a wide margin, and suppressed errors are the only reason not to use it.

Bisect on a known file. /etc/passwd exists on every Linux host. Increase the count until it returns. The transition point is the depth.

Read the source. If php://filter works, read the including file and count the directories in the prefix. This is also how you learn whether the sink executes and whether an extension is appended.

Ask the framework. A stack trace, a debug page, or a 404 handler will often print an absolute path. So will phpinfo() if it is exposed.

In rough order of how often they stop people:

• A prepended directory. include('pages/' . $page). Traversal still works. Every php:// wrapper does not — see PHP Wrappers and Streams.
• An appended extension. include($page . '.php'). You can only reach files ending .php, and the historic bypasses are dead. See Extension Append Bypasses.
• A filter on the input string. str_replace, a regex, a denylist. Almost always beatable, because it is checking spelling rather than resolution. See Beating Blacklists.
• open_basedir. Confines you to the app tree — which usually still contains the config file. See open_basedir and disable_functions.
• An allowlist. This one is the actual fix. If the parameter is mapped through a fixed table, you are done — go and find a different bug.

Work through them in the lab, which lets you toggle each one and watch the resolution change.

A sink whose output never reaches the response is still exploitable, just slower.

Timing. Reading a large file takes measurably longer than failing to open a small one. /dev/random blocks. A deliberately deep traversal into a directory with many entries is slower than a shallow one. Compare a path you know exists against one you know does not.

Differential responses. A 500 for a missing file and a 200 for a present one is an oracle even with no content. That is enough to enumerate the filesystem one path at a time.

Side effects. If the sink executes, an included file that makes an outbound DNS or HTTP request confirms it out of band. This needs a write primitive first — see Log Poisoning.

Error suppression is rarely total. display_errors=Off still writes to the log, and a distinct HTTP status or response length frequently leaks the same information the message would have.