Welcome to the liffy wiki!

• Check URL using the following techniques:

  • data:https://
  • input:https://
  • expect:https://
  • filter:https://

• Use Log poisoning for LFI

  • Apache access.log
  • SSH auth.log

• Use Custom log location

• Use /proc/self/environ for code exec

• Relatively traverse directories