Linux LFI cheatsheet

https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/File%20Inclusion#lfi-to-rce-via-procselfenviron

/proc/self/environ  -> may contain creds
/proc/self/status -> who's running the service?
 

Another way to gain SSH access to a Linux machine through LFI is by reading the private key file, id_rsa. If SSH is active check which user is being used /proc/self/status and /etc/passwd and try to access /username/.ssh/id_rsa.

SecLists/LFI-gracefulsecurity-linux.txt at master · danielmiessler/SecListsGitHub