Strix•路径穿越与文件包含
Strix 路径穿越与文件包含测试手册,覆盖本地/远程文件访问与代码执行链;触发名:strix-path-traversal-lfi-rfi
Profile →npx skills add asdfgh1445/ctf-super-hub --skill strix-path-traversal-lfi-rfi --agent codex
Same command for any agent — swap --agent for claude-code, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
# Path Traversal / LFI / RFI Improper file path handling and dynamic inclusion enable sensitive file disclosure, config/source leakage, SSRF pivots, and code execution. Treat all user-influenced paths, names, and schemes as untrusted; normalize and bind them to an allowlist or eliminate user control entirely. ## Attack Surface **Path Traversal** - Read files outside intended roots via `../`, encoding, normalization gaps **Local File Inclusion (LFI)** - Include server-side files into interpreters/templates **Remote File Inclusion (RFI)** - Include remote resources (HTTP/FTP/wrappers) for code execution **Archive Extraction** - Zip Slip: write outside target directory upon unzip/untar **Normalization Mismatches** - Server/proxy differences (nginx alias/root, upstream decoders) - OS-specific paths: Windows separators, device names, UNC, NT paths, alternate data streams ## High-Value Targets **Unix** - `/etc/passwd`, `/etc/hosts`, application `.env`/`config.yaml` - SSH keys, cloud creds, service configs/logs **Windows** - `C:\Windows\win.ini`, IIS/web.config, programdata configs, application logs **Application** - Source code templates and server-side includes - Secrets in env dumps, f
- Attack Surface
- High-Value Targets
- Reconnaissance
- Surface Map
- Capability Probes
- Detection Channels
- Direct
- Error-Based
- OAST
- Side Effects
- Key Vulnerabilities
- Path Traversal Bypasses
- LFI Wrappers and Techniques
- Template Engines
What does the Strix•路径穿越与文件包含 skill do?
Strix 路径穿越与文件包含测试手册,覆盖本地/远程文件访问与代码执行链;触发名:strix-path-traversal-lfi-rfi
How do I install it?
Run `npx skills add asdfgh1445/ctf-super-hub --skill strix-path-traversal-lfi-rfi --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From asdfgh1445/ctf-super-hub, a repository with 718 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.