LFIDump
A simple python script to dump remote files through a local file read or local file inclusion web vulnerability.
Features
- Dump a single file with
-f /path/to/remote/file.txt - Dump lots of files from a wordlist with
-F /path/to/local/wordlist.txt - Insecure mode (for broken SSL/TLS) with
-k/--insecure - Custom local dump dir with
-d/--dump-dir
Usage
$ ./LFIDump.py -h
usage: LFIDump.py [-h] [-v] [-s] -u URL [-f FILE | -F FILELIST] [-D DUMP_DIR] [-k]
Description message
optional arguments:
-h, --help show this help message and exit
-v, --verbose Verbose mode. (default: False)
-s, --only-success Only print successful read file attempts.
-u URL, --url URL URL to connect to. (example: http://localhost/?page=LFIPATH)
-f FILE, --file FILE Remote file to read.
-F FILELIST, --filelist FILELIST
File containing a list of paths to files to read remotely.
-D DUMP_DIR, --dump-dir DUMP_DIR
Directory where the dumped files will be stored.
-k, --insecure Allow insecure server connections when using SSL (default: False)
Examples
-
Dump a single file
./LFIDump.py -u "http://localhost:8000/lfi.php?page=LFIPATH" -f /etc/passwd -
Dump files from a wordlist
./LFIDump.py -u "http://localhost:8000/lfi.php?page=LFIPATH" -F ./wordlists/all.txt
Contributing
Pull requests are welcome. Feel free to open an issue if you want to add other features.
25 Nov 15, 2022
187 Jan 3, 2023
1 Dec 15, 2021
16 Nov 9, 2022
8 Oct 20, 2022
1 Dec 16, 2021
12 Dec 2, 2022
4 Jan 10, 2022
2 Dec 12, 2021
2 Oct 05, 2022
41 Nov 22, 2022
34 Dec 01, 2022
14 Oct 15, 2022
1 Nov 10, 2021
2 Jun 01, 2022
33 Nov 27, 2022
212 Dec 24, 2022
431 Dec 22, 2022
1 Dec 28, 2021
36 Dec 20, 2022
1 Nov 02, 2021
10 Oct 15, 2022
622 Jan 04, 2023
7 Nov 24, 2022
1 Dec 03, 2021
14 Oct 18, 2022
823 Dec 21, 2022
4 Apr 05, 2022
283 Dec 29, 2022