LFIDump
A simple python script to dump remote files through a local file read or local file inclusion web vulnerability.
Features
- Dump a single file with
-f /path/to/remote/file.txt - Dump lots of files from a wordlist with
-F /path/to/local/wordlist.txt - Insecure mode (for broken SSL/TLS) with
-k/--insecure - Custom local dump dir with
-d/--dump-dir
Usage
$ ./LFIDump.py -h
usage: LFIDump.py [-h] [-v] [-s] -u URL [-f FILE | -F FILELIST] [-D DUMP_DIR] [-k]
Description message
optional arguments:
-h, --help show this help message and exit
-v, --verbose Verbose mode. (default: False)
-s, --only-success Only print successful read file attempts.
-u URL, --url URL URL to connect to. (example: http://localhost/?page=LFIPATH)
-f FILE, --file FILE Remote file to read.
-F FILELIST, --filelist FILELIST
File containing a list of paths to files to read remotely.
-D DUMP_DIR, --dump-dir DUMP_DIR
Directory where the dumped files will be stored.
-k, --insecure Allow insecure server connections when using SSL (default: False)
Examples
-
Dump a single file
./LFIDump.py -u "http://localhost:8000/lfi.php?page=LFIPATH" -f /etc/passwd -
Dump files from a wordlist
./LFIDump.py -u "http://localhost:8000/lfi.php?page=LFIPATH" -F ./wordlists/all.txt
Contributing
Pull requests are welcome. Feel free to open an issue if you want to add other features.
25 Nov 15, 2022
187 Jan 3, 2023
1 Dec 15, 2021
16 Nov 9, 2022
8 Oct 20, 2022
1 Dec 16, 2021
12 Dec 2, 2022
4 Jan 10, 2022
2 Dec 12, 2021
701 Dec 27, 2022
1 Jun 21, 2022
3 Feb 21, 2022
15 Dec 22, 2022
2 Feb 15, 2022
1 Dec 26, 2021
![Risky [ Zero Tow ]](https://avatars.githubusercontent.com/u/76860656?v=4&s=60)
7 Dec 25, 2022
181 Dec 20, 2022
3 Apr 02, 2022
29.7k Jan 04, 2023
2 Mar 20, 2022
6 Aug 07, 2021
291 Dec 28, 2022
56 Jul 31, 2022
8 Nov 10, 2022
861 Feb 18, 2021
9 Dec 12, 2022
329 Jan 01, 2023
0 Aug 28, 2022
137 Jan 02, 2023