https://lukaszpastuszak.dev/tags/lfi/Recent content in Lfi on Łukasz Pastuszak - security notesHugoen-usSun, 06 Sep 2026 00:00:00 +0000https://lukaszpastuszak.dev/writeups/pollution/Sun, 06 Sep 2026 00:00:00 +0000https://lukaszpastuszak.dev/writeups/pollution/A leaked Burp export gives an admin token and XXE, Redis session tampering reaches a developers portal, an LFI PHP filter chain lands RCE, FastCGI pivots to victor, and prototype pollution in a Node.js API run as root gives a root shell.https://lukaszpastuszak.dev/writeups/sniper/Sun, 06 Sep 2026 00:00:00 +0000https://lukaszpastuszak.dev/writeups/sniper/LFI in a language parameter plus PHP session poisoning gives RCE as IUSR, a leaked database password reused via PSCredential reaches chris, and a malicious CHM captures the administrator's Net-NTLMv2 for SYSTEM.https://lukaszpastuszak.dev/writeups/timing/Sun, 06 Sep 2026 00:00:00 +0000https://lukaszpastuszak.dev/writeups/timing/A login timing side channel enumerates users, mass assignment sets role=1, an LFI plus php://filter discloses source, a predictable MD5(time()) upload name gives RCE, a git history leak yields a reused password, and Axel's .axelrc default_filename overwrites root's authorized_keys.