vainlystrain/vailynA phased, evasive Path Traversal + LFI scanning & exploitation tool in Python
Phased Path Traversal & LFI Attacks
Vailyn 3.0
Since v3.0, Vailyn supports LFI PHP wrappers in Phase 1. Use
--lfito include them in the scan.
Vailyn is a multi-phased vulnerability analysis and exploitation tool for path traversal and file inclusion vulnerabilities. It is built to make it as performant as possible, and to offer a wide arsenal of filter evasion techniques.
Vailyn operates in 2 phases. First, it checks if the vulnerability is present. It does so by trying to access /etc/passwd (or a user-specified file), with all of its evasive payloads. Analysing the response, payloads that worked are separated from the others.
Now, the user can choose freely which payloads to use. Only these payloads will be used in the second phase.
The second phase is the exploitation phase. Now, it tries to leak all possible files from the server using a file and a directory dictionary. The search depth and the directory permutation level can be adapted via arguments. Optionally, it can download found files, and save them in its loot folder. Alternatively, it will try to obtain a reverse shell on the system, letting the attacker gain full control over the server.
Right now, it supports multiple attack vectors: injection via query, path, cookie and POST data.
The separation in several phases is done to hugely improve the performance of the tool. In previous versions, every file-directory combination was checked with every payload. This resulted in a huge overhead due to payloads being always used again, despite not working for the current page.
Recommended & tested Python versions are 3.7+, but it should work fine with Python 3.5 & Python 3.6, too. To install Vailyn, download the archive from the release tab, or perform
$ git clone https://github.com/VainlyStrain/Vailyn
Once on your system, you'll need to install the Python dependencies.
On Unix systems, it is sufficient to run
$ pip install -r requirements.txt # --user
Some libraries Vailyn uses do not work well with Windows, or will fail to install.
If you use Windows, use pip to install the requirements listed in Vailyn\·›\requirements-windows.txt.
If twisted fails to install, there is an unofficial version available here, which should build under Windows. Just bear in mind that this is a 3rd party download, and the integrity isn't necessarily guaranteed. After this installed successfully, running pip again on requirements-windows.txt should work.
If you want to fully use the reverse shell module, you'll need to have sshpass, ncat and konsole installed. Package names vary by Linux distribution. On Windows, you'll need to start the listener manually beforehand. If you don't like konsole, you can specify a different terminal emulator in core/config.py.
That's it! Fire Vailyn up by moving to its installation directory and performing
$ python Vailyn -h
Vailyn has 3 mandatory arguments: -v VIC, -a INT and -p2 TP P1 P2. However, depending on -a, more arguments may be required.
, \ / ,
':. \. /\. ./ .:'
':;. :\ .,:/ ''. /; ..::'
',':.,.__.'' ' ' `:.__:''.:'
';.. ,;' *
* '., .:'
`v;. ;v' o
. ' '.. :.' ' .
' ':;, ' '
o ' . :
*
| Vailyn |
[ VainlyStrain ]
Vsynta Vailyn -v VIC -a INT -p2 TP P1 P2
[-p PAM] [-i F] [-Pi VIC2]
[-c C] [-n] [-d I J K]
[-s T] [-t] [-L]
[-l] [-P] [-A]
mandatory:
-v VIC, --victim VIC Target to attack, part 1 [pre-payload]
-a INT, --attack INT Attack type (int, 1-5, or A)
A| Spider (all) 2| Path 5| POST Data, json
P| Spider (partial) 3| Cookie
1| Query Parameter 4| POST Data, plain
-p2 TP P1 P2, --phase2 TP P1 P2
Attack in Phase 2, and needed parameters
┌[ Values ]─────────────┬────────────────────┐
│ TP │ P1 │ P2 │
├─────────┼─────────────┼────────────────────┤
│ leak │ File Dict │ Directory Dict │
│ inject │ IP Addr │ Listening Port │
│ implant │ Source File │ Server Destination │
└─────────┴─────────────┴────────────────────┘
additional:
-p PAM, --param PAM query parameter or POST data for --attack 1, 4, 5
-i F, --check F File to check for in Phase 1 (df: etc/passwd)
-Pi VIC2, --vic2 VIC2 Attack Target, part 2 [post-payload]
-c C, --cookie C Cookie to append (in header format)
-l, --loot Download found files into the loot folder
-d I J K, --depths I J K
depths (I: phase 1, J: phase 2, K: permutation level)
-h, --help show this help menu and exit
-s T, --timeout T Request Timeout; stable switch for Arjun
-t, --tor Pipe attacks through the Tor anonymity network
-L, --lfi Additionally use PHP wrappers to leak files
-n, --nosploit skip Phase 2 (does not need -p2 TP P1 P2)
-P, --precise Use exact depth in Phase 1 (not a range)
-A, --app Start Vailyn's Qt5 interface
develop:
--debug Display every path tried, even 404s.
--version Print program version and exit.
--notmain Avoid notify2 crash in subprocess call.
Info:
to leak files using absolute paths: -d 0 0 0
to get a shell using absolute paths: -d 0 X 0
Vailyn currently supports 5 attack vectors, and provides a crawler to automate all of them. The attack performed is identified by the -a INT argument.
INT attack
---- -------
1 query-based attack (https://site.com?file=../../../)
2 path-based attack (https://site.com/../../../)
3 cookie-based attack (will grab the cookies for you)
4 plain post data (ELEM1=VAL1&ELEM2=../../../)
5 json post data ({"file": "../../../"})
A spider fetch + analyze all URLs from site using all vectors
P partial spider fetch + analyze all URLs from site using only selected vectors
You also must specify a target to attack. This is done via -v VIC and -Pi VIC2, where -v is the part before the injection point, and -Pi the rest.
Example: if the final URL should look like: https://site.com/download.php?file=<ATTACK>¶m2=necessaryvalue, you can specify -v https://site.com/download.php and -Pi ¶m2=necessaryvalue (and -p file, since this is a query attack).
If you want to include PHP wrappers in the scan (like php://filter), use the --lfi argument. At the end of Phase 1, you'll be presented with an additional selection menu containing the wrappers that worked. (if any)