LFIDump
A simple python script to dump remote files through a local file read or local file inclusion web vulnerability.
Features
- Dump a single file with
-f /path/to/remote/file.txt - Dump lots of files from a wordlist with
-F /path/to/local/wordlist.txt - Insecure mode (for broken SSL/TLS) with
-k/--insecure - Custom local dump dir with
-d/--dump-dir
Usage
$ ./LFIDump.py -h
usage: LFIDump.py [-h] [-v] [-s] -u URL [-f FILE | -F FILELIST] [-D DUMP_DIR] [-k]
Description message
optional arguments:
-h, --help show this help message and exit
-v, --verbose Verbose mode. (default: False)
-s, --only-success Only print successful read file attempts.
-u URL, --url URL URL to connect to. (example: http://localhost/?page=LFIPATH)
-f FILE, --file FILE Remote file to read.
-F FILELIST, --filelist FILELIST
File containing a list of paths to files to read remotely.
-D DUMP_DIR, --dump-dir DUMP_DIR
Directory where the dumped files will be stored.
-k, --insecure Allow insecure server connections when using SSL (default: False)
Examples
-
Dump a single file
./LFIDump.py -u "http://localhost:8000/lfi.php?page=LFIPATH" -f /etc/passwd -
Dump files from a wordlist
./LFIDump.py -u "http://localhost:8000/lfi.php?page=LFIPATH" -F ./wordlists/all.txt
Contributing
Pull requests are welcome. Feel free to open an issue if you want to add other features.
25 Nov 15, 2022
187 Jan 3, 2023
1 Dec 15, 2021
16 Nov 9, 2022
8 Oct 20, 2022
1 Dec 16, 2021
12 Dec 2, 2022
4 Jan 10, 2022
2 Dec 12, 2021
2 Dec 22, 2021
5 Dec 03, 2022
40 Dec 21, 2022
9k Jan 03, 2023
168 Nov 09, 2022
11 Nov 15, 2022
181 Jan 02, 2023
153 Dec 20, 2022
33 Jul 01, 2022
2 Feb 05, 2022
59 Nov 26, 2022
10 Nov 23, 2022
9 Aug 31, 2022
35 Dec 12, 2022
2 Jan 24, 2022
3 Nov 04, 2022
757 Jan 07, 2023
1.3k Jan 03, 2023
9 Mar 05, 2022
39 Nov 21, 2022