Lfi Generator

Test your own application for local file inclusion and path traversal

Testing whether your own application is vulnerable to local file inclusion and path traversal is part of securing it, and doing so requires understanding the vulnerability class. This tool helps you generate test cases for local file inclusion and path traversal so you can check your own application, under authorisation, and confirm that your defences hold. The test cases help you verify that your application cannot be tricked into reading or including files outside its intended directory.

Why this vulnerability matters

Path traversal and local file inclusion occur when an application uses user input to build a file path without restriction, letting input reference files outside the intended location. It can expose sensitive files. It appears in the OWASP Top Ten precisely because it is common and serious, which is why testing for it against your own applications, and understanding how it works, is essential to defending against it.

The defence, and responsible use

The defence is to never build file paths from raw user input, to validate against an allowlist of permitted files, and to resolve and check the final path stays within the intended directory. Testing confirms the restriction holds. This tool is for authorised security testing of systems you own or have explicit permission to test, for security research, and for education, testing without authorisation is illegal and unethical. It runs entirely in your browser, so nothing you enter is uploaded.

Related tools

• User Agent Parser — Parse a User-Agent string into browser, engine, operating system and device. Explains why UA strings are unreliable and what to use instead.
• QR Code Generator — Generate QR codes for URLs, text, Wi-Fi and contact details. Adjustable error correction and size, produced entirely in your browser.
• Credit Card Validator — Validate a card number with the Luhn algorithm and identify the issuing network from its prefix. Runs locally, nothing is transmitted.
• Text Case Converter — Convert text between camelCase, PascalCase, snake_case, kebab-case, CONSTANT_CASE, Title Case and sentence case. Runs entirely in your browser.