# 2. Basic Bypasses

**Key Takeaways:**

* **Non-Recursive Path Traversal Filters:**
  * Exploiting filters that only replace `../` once.
  * Bypasses: `....//`, `..././`, `....\/`.
  * Highlights the importance of recursive filtering.
* **Encoding:**
  * Bypassing filters that block specific characters (`.`, `/`).
  * Techniques: URL encoding (`%2e%2e%2f`), double encoding.
  * Emphasizes the need for proper input decoding.
* **Approved Paths:**
  * Bypassing filters that restrict file inclusion to specific directories.
  * Technique: Starting the payload with the approved path and then using path traversal.
  * Shows how to combine bypass techniques.
* **Appended Extension:**
  * Addressing web applications that append extensions (e.g., `.php`).
  * **Path Truncation (Obsolete):**
    * Exploiting length limitations in older PHP versions.
    * Technique: Creating long strings to truncate the appended extension.
    * Important to note that this is mostly historical information.
  * **Null Bytes (Obsolete):**
    * Exploiting null byte injection vulnerabilities in older PHP versions.
    * Technique: Appending `%00` to truncate the appended extension.
    * Also very important to note that this is mostly historical information.

**Additional Considerations:**

* **Real-World Scenarios:**
  * In real-world scenarios, web applications often combine multiple filters and protections.
  * Attackers need to be creative and combine different bypass techniques.
* **Regular Expression Complexity:**
  * Complex regular expressions can sometimes introduce new vulnerabilities.
  * Attackers may try to find edge cases or unexpected behavior in the regex.
* **WAF (Web Application Firewall) Bypasses:**
  * WAFs can also block LFI attacks.
  * Attackers may use encoding, obfuscation, or other techniques to bypass WAF rules.
* **Modern PHP Security:**
  * Modern PHP versions have significantly improved security against LFI vulnerabilities.
  * Developers should still follow best practices for input validation and sanitization.
* **Defense in Depth:**
  * Implementing multiple layers of security is crucial.
  * This includes input validation, access controls, and regular security audits.
* **Testing:**
  * It is very important to test all user supplied input. Fuzzing tools can be very useful for this.
* **Least Privilege:**
  * File system permissions should follow the principle of least privilege. The web server should only have access to the files it absolutely needs.

#### Code Examples

**Non-Recursive Path Traversal Bypass**

```
### Using traversal bypass techniques
curl "http://example.com/?file=....//etc/passwd"
```

**Encoding Bypass**

```
### Using URL encoding to bypass restrictions
curl "http://example.com/?file=%2e%2e%2fetc/passwd"
```

**PHP Wrappers for LFI**

```
### Using PHP filter wrapper to read source code
curl "http://example.com/?file=php://filter/convert.base64-encode/resource=index.php"
```
