shivendrachauhanhacker/lfi-practice-range repository overview

⁠LFI Practice Range

20 intentionally vulnerable Local File Inclusion (LFI) and path-traversal labs in a single self-contained web app — built for hands-on web penetration testing training, CTF practice, and security coursework.

Created by Shivendra Chauhan — Indian Cyber Education⁠ on YouTube.

⁠Quick start

docker run -p 5000:5000 shivendrachauhanhacker/lfi-practice-range:latest

Then open http://localhost:5000⁠ in your browser.

⁠What's inside

10 vulnerability classes across 20 labs, Easy → Expert:

• Fundamentals — raw path traversal, broken startswith() containment checks
• Broken blacklists — incomplete keyword lists, non-recursive ../ stripping, length-limited filters
• Encoding bypasses — raw-vs-decoded mismatches, double URL-encoding
• Language-specific gotchas — Python's os.path.join() absolute-path override
• Historical techniques — the classic null-byte extension-truncation trick
• Broken whitelists — a regex that looks strict but isn't
• Alternate injection points — HTTP headers, cookies, parameter pollution
• LFI-to-RCE chains — log poisoning, session poisoning, upload chaining
• Wrapper techniques — custom b64:// source disclosure, zip:// archive abuse
• Capstone — a triple-stacked filter requiring multiple bypasses chained together

Every lab includes an in-app scenario, goal, progressive hints, and a "try it" form. A full written solutions PDF (one lab per page, with payloads and explanations) is included and linked from every lab page.

⁠Safety design

Every vulnerability only ever touches files inside a bundled sandbox directory — fake /etc/passwd, fake credentials, no real system files. Labs that demonstrate LFI-to-RCE chains simulate "code execution" through safe text substitution only; the app never calls subprocess, eval, or exec.

⁠Tags

• latest — most recent build

⁠Links

• Full source, walkthroughs, and setup docs: see the project README
• YouTube: https://www.youtube.com/indiancybereducation⁠

⁠License / usage

Provided for authorized security education and coursework only. Do not scan, exploit, or test systems you do not own or do not have explicit written permission to test.