I have these two LFI filters and i want to bypass them
$bad = str_replace('../','',$_GET['bad']);
while( substr_count($bad, '../', 0)) {
$bad = str_replace('../', '', $bad);
};
include("./".$bad);
I tried various ways and i was not able to bypass them, also the php wrappers are mostly used in php 5.* versions and before and i have php 7.6 version.
../
. What other options have you tried?..\` that will be normalized into
../` or you can try.;./
or%2e%2e/