diff --git a/src/linux-hardening/privilege-escalation/README.md b/src/linux-hardening/privilege-escalation/README.md
index 835a6bdb1..6c419ccb0 100644
--- a/src/linux-hardening/privilege-escalation/README.md
+++ b/src/linux-hardening/privilege-escalation/README.md
@@ -1630,6 +1630,15 @@ escaping-from-limited-bash.md
 cisco-vmanage.md
 {{#endref}}
 
+## Android rooting frameworks: manager-channel abuse
+
+Android rooting frameworks commonly hook a syscall to expose privileged kernel functionality to a userspace manager. Weak manager authentication (e.g., signature checks based on FD-order or poor password schemes) can enable a local app to impersonate the manager and escalate to root on already-rooted devices. Learn more and exploitation details here:
+
+
+{{#ref}}
+android-rooting-frameworks-manager-auth-bypass-syscall-hook.md
+{{#endref}}
+
 ## Kernel Security Protections
 
 - [https://github.com/a13xp0p0v/kconfig-hardened-check](https://github.com/a13xp0p0v/kconfig-hardened-check)
@@ -1675,13 +1684,4 @@ cisco-vmanage.md
 - [https://www.linode.com/docs/guides/what-is-systemd/](https://www.linode.com/docs/guides/what-is-systemd/)
 
 
-## Android rooting frameworks: manager-channel abuse
-
-Android rooting frameworks commonly hook a syscall to expose privileged kernel functionality to a userspace manager. Weak manager authentication (e.g., signature checks based on FD-order or poor password schemes) can enable a local app to impersonate the manager and escalate to root on already-rooted devices. Learn more and exploitation details here:
-
-
-{{#ref}}
-android-rooting-frameworks-manager-auth-bypass-syscall-hook.md
-{{#endref}}
-
 {{#include ../../banners/hacktricks-training.md}}
diff --git a/src/network-services-pentesting/pentesting-web/apache.md b/src/network-services-pentesting/pentesting-web/apache.md
index 197d80d01..2d7a1232e 100644
--- a/src/network-services-pentesting/pentesting-web/apache.md
+++ b/src/network-services-pentesting/pentesting-web/apache.md
@@ -27,6 +27,38 @@ uid=1(daemon) gid=1(daemon) groups=1(daemon)
 Linux
 ```
 
+## LFI via .htaccess ErrorDocument file provider (ap_expr)
+
+If you can control a directory’s .htaccess and AllowOverride includes FileInfo for that path, you can turn 404 responses into arbitrary local file reads using the ap_expr file() function inside ErrorDocument.
+
+- Requirements:
+  - Apache 2.4 with expression parser (ap_expr) enabled (default in 2.4).
+  - The vhost/dir must allow .htaccess to set ErrorDocument (AllowOverride FileInfo).
+  - The Apache worker user must have read permissions on the target file.
+
+.htaccess payload:
+
+```apache
+# Optional marker header just to identify your tenant/request path
+Header always set X-Debug-Tenant "demo"
+# On any 404 under this directory, return the contents of an absolute filesystem path
+ErrorDocument 404 %{file:/etc/passwd}
+```
+
+Trigger by requesting any non-existing path below that directory, for example when abusing userdir-style hosting:
+
+```bash
+curl -s http://target/~user/does-not-exist | sed -n '1,20p'
+```
+
+Notes and tips:
+- Only absolute paths work. The content is returned as the response body for the 404 handler.
+- Effective read permissions are those of the Apache user (typically www-data/apache). You won’t read /root/* or /etc/shadow in default setups.
+- Even if .htaccess is root-owned, if the parent directory is tenant-owned and permits rename, you may be able to rename the original .htaccess and upload your own replacement via SFTP/FTP:
+  - rename .htaccess .htaccess.bk
+  - put your malicious .htaccess
+- Use this to read application source under DocumentRoot or vhost config paths to harvest secrets (DB creds, API keys, etc.).
+
 ## Confusion Attack <a href="#a-whole-new-attack-confusion-attack" id="a-whole-new-attack-confusion-attack"></a>
 
 These types of attacks has been introduced and documented [**by Orange in this blog post**](https://blog.orange.tw/2024/08/confusion-attacks-en.html?m=1) and the following is a summary. The "confusion" attack basically abuses how the tens of modules that work together creating a Apache don't work perfectly synchronised and making some of them modify some unexpected data can cause a vulnerability in a later module.
@@ -274,8 +306,8 @@ Check [**Docker PHP LFI Summary**](https://www.leavesongs.com/PENETRATION/docker
 ## References
 
 - [https://blog.orange.tw/2024/08/confusion-attacks-en.html?m=1](https://blog.orange.tw/2024/08/confusion-attacks-en.html?m=1)
+- [Apache 2.4 Custom Error Responses (ErrorDocument)](https://httpd.apache.org/docs/2.4/custom-error.html)
+- [Apache 2.4 Expressions and functions (file:)](https://httpd.apache.org/docs/2.4/expr.html)
+- [HTB Zero write-up: .htaccess ErrorDocument LFI and cron pgrep abuse](https://0xdf.gitlab.io/2025/08/12/htb-zero.html)
 
 {{#include ../../banners/hacktricks-training.md}}
-
-
-