We’re rewarding the question askers & reputations are being recalculated! Read more.
2 Added possible explanation for base64
source | link

It is a null byte character.

It is used if the code always appends an extension to the included file. For example, if the code is

<?php
include($_GET['lang'].".php");
?>

However, you, as the attacker wish to read ../../etc/passwd using the LFI. If you use the null byte character you can append this to the request URL as %00:

www.example.com/index.php?lang=../../etc/passwd%00

This will make the PHP processor stop at the null byte and include the file ../../etc/passwd rather than the path ../../etc/passwd.php which won't work due to the extension. So in summary it gives the attacker a way to truncate the path at a given point and remove any undesired extension.

Regarding the base64 encoding - this could be to prevent the null byte from being "lost" in transit. If you use any mechanism to transfer the URL elsewhere, the software used might terminate the string at the null byte and this would be removed from the URL. An example is if you paste a URL into Firefox, often the string is terminated at the null byte and the page request when made does not include the null byte character.

It is a null byte character.

It is used if the code always appends an extension to the included file. For example, if the code is

<?php
include($_GET['lang'].".php");
?>

However, you, as the attacker wish to read ../../etc/passwd using the LFI. If you use the null byte character you can append this to the request URL as %00:

www.example.com/index.php?lang=../../etc/passwd%00

This will make the PHP processor stop at the null byte and include the file ../../etc/passwd rather than the path ../../etc/passwd.php which won't work due to the extension. So in summary it gives the attacker a way to truncate the path at a given point and remove any undesired extension.

It is a null byte character.

It is used if the code always appends an extension to the included file. For example, if the code is

<?php
include($_GET['lang'].".php");
?>

However, you, as the attacker wish to read ../../etc/passwd using the LFI. If you use the null byte character you can append this to the request URL as %00:

www.example.com/index.php?lang=../../etc/passwd%00

This will make the PHP processor stop at the null byte and include the file ../../etc/passwd rather than the path ../../etc/passwd.php which won't work due to the extension. So in summary it gives the attacker a way to truncate the path at a given point and remove any undesired extension.

Regarding the base64 encoding - this could be to prevent the null byte from being "lost" in transit. If you use any mechanism to transfer the URL elsewhere, the software used might terminate the string at the null byte and this would be removed from the URL. An example is if you paste a URL into Firefox, often the string is terminated at the null byte and the page request when made does not include the null byte character.

1
source | link

It is a null byte character.

It is used if the code always appends an extension to the included file. For example, if the code is

<?php
include($_GET['lang'].".php");
?>

However, you, as the attacker wish to read ../../etc/passwd using the LFI. If you use the null byte character you can append this to the request URL as %00:

www.example.com/index.php?lang=../../etc/passwd%00

This will make the PHP processor stop at the null byte and include the file ../../etc/passwd rather than the path ../../etc/passwd.php which won't work due to the extension. So in summary it gives the attacker a way to truncate the path at a given point and remove any undesired extension.