LFI and Path Traversal Attack in HTTP URI

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•3

This rule detects HTTP requests attempting to perform Local File Inclusion (LFI) or path traversal attacks by searching for patterns such as '/../' sequences and common sensitive file paths like /etc/passwd, /etc/shadow, or /proc/self/environ in the URI.