LFIDump
A simple python script to dump remote files through a local file read or local file inclusion web vulnerability.
Features
- Dump a single file with
-f /path/to/remote/file.txt - Dump lots of files from a wordlist with
-F /path/to/local/wordlist.txt - Insecure mode (for broken SSL/TLS) with
-k/--insecure - Custom local dump dir with
-d/--dump-dir
Usage
$ ./LFIDump.py -h
usage: LFIDump.py [-h] [-v] [-s] -u URL [-f FILE | -F FILELIST] [-D DUMP_DIR] [-k]
Description message
optional arguments:
-h, --help show this help message and exit
-v, --verbose Verbose mode. (default: False)
-s, --only-success Only print successful read file attempts.
-u URL, --url URL URL to connect to. (example: http://localhost/?page=LFIPATH)
-f FILE, --file FILE Remote file to read.
-F FILELIST, --filelist FILELIST
File containing a list of paths to files to read remotely.
-D DUMP_DIR, --dump-dir DUMP_DIR
Directory where the dumped files will be stored.
-k, --insecure Allow insecure server connections when using SSL (default: False)
Examples
-
Dump a single file
./LFIDump.py -u "http://localhost:8000/lfi.php?page=LFIPATH" -f /etc/passwd -
Dump files from a wordlist
./LFIDump.py -u "http://localhost:8000/lfi.php?page=LFIPATH" -F ./wordlists/all.txt
Contributing
Pull requests are welcome. Feel free to open an issue if you want to add other features.
25 Nov 15, 2022
187 Jan 3, 2023
1 Dec 15, 2021
16 Nov 9, 2022
8 Oct 20, 2022
1 Dec 16, 2021
12 Dec 2, 2022
4 Jan 10, 2022
2 Dec 12, 2021
2 Jul 23, 2022
27 Dec 25, 2022
16 Sep 06, 2022
588 Jan 09, 2023
298 Dec 14, 2022
36 Dec 04, 2022
24 Dec 10, 2021
34 Dec 01, 2022
22 Oct 17, 2022
1 May 19, 2022
3 Jan 23, 2022
25 Nov 09, 2022
5k Jan 05, 2023
3 Feb 07, 2022
2.2k Jan 08, 2023
216 Jan 08, 2023
11 Nov 17, 2022
2 Jan 04, 2022
36 Dec 20, 2022
9 Jun 01, 2022