LFIDump
A simple python script to dump remote files through a local file read or local file inclusion web vulnerability.
Features
- Dump a single file with
-f /path/to/remote/file.txt - Dump lots of files from a wordlist with
-F /path/to/local/wordlist.txt - Insecure mode (for broken SSL/TLS) with
-k/--insecure - Custom local dump dir with
-d/--dump-dir
Usage
$ ./LFIDump.py -h
usage: LFIDump.py [-h] [-v] [-s] -u URL [-f FILE | -F FILELIST] [-D DUMP_DIR] [-k]
Description message
optional arguments:
-h, --help show this help message and exit
-v, --verbose Verbose mode. (default: False)
-s, --only-success Only print successful read file attempts.
-u URL, --url URL URL to connect to. (example: http://localhost/?page=LFIPATH)
-f FILE, --file FILE Remote file to read.
-F FILELIST, --filelist FILELIST
File containing a list of paths to files to read remotely.
-D DUMP_DIR, --dump-dir DUMP_DIR
Directory where the dumped files will be stored.
-k, --insecure Allow insecure server connections when using SSL (default: False)
Examples
-
Dump a single file
./LFIDump.py -u "http://localhost:8000/lfi.php?page=LFIPATH" -f /etc/passwd -
Dump files from a wordlist
./LFIDump.py -u "http://localhost:8000/lfi.php?page=LFIPATH" -F ./wordlists/all.txt
Contributing
Pull requests are welcome. Feel free to open an issue if you want to add other features.
25 Nov 15, 2022
187 Jan 3, 2023
1 Dec 15, 2021
16 Nov 9, 2022
8 Oct 20, 2022
1 Dec 16, 2021
12 Dec 2, 2022
4 Jan 10, 2022
2 Dec 12, 2021
3 Dec 04, 2022
17 Sep 25, 2022
2 Mar 20, 2022
7 Jan 07, 2022
66 Nov 08, 2022
10 Jul 28, 2022
82 Dec 28, 2022
6 Jan 22, 2022
5 Oct 08, 2022
4 Aug 08, 2022
1 Nov 04, 2021
86 Dec 31, 2022
96 Jan 02, 2023
2 Jun 01, 2022
9 Nov 23, 2022
1 Dec 24, 2021
7 Sep 16, 2022
1 Dec 18, 2021
43 Dec 23, 2022
62 Dec 23, 2022