一个 Python3 工具，用于检测和利用本地文件包含漏洞，具备爬取、路径遍历和过滤器绕过载荷，以及通过日志投毒或 PHP 包装器实现自动化反向 shell。
• 本工具仅供教育目的使用。
• 开发者及协作者不对本工具的任何非法使用承担责任。
LFITester 是一个 Python3 工具，用于测试服务器是否存在本地文件包含（LFI）攻击漏洞。
它可在 Linux/Unix 系统上运行，也可在 Windows 上运行。要使用本程序：
• 你的系统中必须安装 Python3，或从 https://www.python.org/downloads/ 下载。
• 你还需要 pip，如果没有，在 Linux 上运行 sudo apt install python3-pip 即可。
• 下载程序或将仓库克隆到你的系统中 git clone https://github.com/kostas-pa/LFITester.git
• 进入 LFITester 文件夹
• 首先运行命令 sudo chmod +x setup.sh
• 然后运行 sudo ./setup.sh，它会自动安装所需的软件包
• 之后你就可以直接以命令方式运行 lfitester。
• 建议在发起攻击前运行 --update 标志
$python3 LFITester.py
└──╼ $./LFITester.py
_ ______ _____ _______ _
| | | ____|_ _|__ __| | |
| | | |__ | | | | ___ ___| |_ ___ _ __
| | | __| | | | |/ _ \/ __| __/ _ \ '__|
| |____| | _| |_ | | __/\__ \ || __/ |
|______|_| |_____| |_|\___||___/\__\___|_|
**********************************************************************************************************************************************************************************************
LFITester
Automated LFI Testing
**********************************************************************************************************************************************************************************************
usage: LFITester.py [-h] [-u URL] [-L URL_File] [-c] [-v] [-o [OUTFILE]] [--creds [user:pass]] [-p] [--autopwn IP]
[-m Payload] [-f] [--update] [--batch-ans BATCH] [-s] [--poc-file POC] [-H HEADERS] [-C COOKIES]
Payload Modes:
0: Simple bash TCP
1: Alternative bash TCP
2: Simple sh UDP
3: Alternative sh TCP
4: Perl TCP
5: Alternative Perl TCP
6: Python TCP
7: Alternative python TCP
8: Alternative 2 python TCP
9: Alternative 3 python TCP
10: Alternative (No Spaces) python TCP
11: Alternative (No Spaces) 2 python TCP
12: Alternative (No Spaces) 3 python TCP
13: Alternative (No Spaces) Shortened python TCP
14: Alternative (No Spaces) Shortened 2 python TCP
15: Alternative (No Spaces) Shortened 3 python TCP
16: Alternative (No Spaces) Shortened Further python TCP
17: Alternative (No Spaces) Shortened Further 2 python TCP
18: Alternative (No Spaces) Shortened Further 3 python TCP
19: Python3 TCP
20: Alternative python3 TCP
21: Alternative 2 python3 TCP
22: Alternative 3 python3 TCP
23: Alternative (No Spaces) python3 TCP
24: Alternative (No Spaces) 2 python3 TCP
25: Alternative (No Spaces) 3 python3 TCP
26: Alternative (No Spaces) Shortened python3 TCP
27: Alternative (No Spaces) Shortened 2 python3 TCP
28: Alternative (No Spaces) Shortened 3 python3 TCP
29: Alternative (No Spaces) Shortened Further python3 TCP
30: Alternative (No Spaces) Shortened Further 2 python3 TCP
31: Alternative (No Spaces) Shortened Further 3 python3 TCP
32: Php exec
33: Php shell_exec
34: Php over sh
35: Php system
36: Php passthru
37: Php popen
38: Php proc_open
39: Ruby
40: Ruby Alternative
41: Go
42: Netcat sh
43: Netcat bash
44: Netcat alternative bash
45: Netcat openBSD
46: Ncat
47: Ncat UDP
options:
-h, --help show this help message and exit
-u URL, --url URL The url to test. The URL usually is http://[URL]?[something]=
-L URL_File, --list-url URL_File
Input a list of URLs from an external file. The URLs format usually is http://[URL]?[something]=
-c, --crawl use the crawler to test all the endpoints
-v, --verbose Increase output verbosity
-o [OUTFILE], --output [OUTFILE]
The file to save the results
--creds [user:pass] The credentials to login
-p, --enable-proxies Enable proxy redirection. Default proxies are free and you can change them. If you don't want the
default proxies you can supply your own and this option will be overridden! Note that the proxies
will be picked at random for each request
--autopwn IP If the webapp is vulnerable to LFI then it will attempt to exploit it and give back a shell. This
option requires your IP in order to connect with the revshell
-m Payload, --mode Payload
Select the payload that suits best. Try different ones if the exploit doesn't work.
-f, --force Treat endpoint as alive even if it returns 404
--update Update LFITester
--batch-ans BATCH Answer all yes/no
-s, --stealth Enable stealth mode
--poc-file POC Your custom poc file.
-H HEADERS, --headers HEADERS
Add extra headers
-C COOKIES, --cookies COOKIES
Add extra cookies
-r PACKET_FILE, --packet-file PACKET_FILE
Import headers/cookies/body from a packet file (HTTP or Burp format)
Proxies in the list must be in the following format: protocol://{proxyip}
username:password (newline). If you dont have a authenticated
proxy then skip the username:password entry and go for a new line
Examples:
LFITester.py -u "http://URL?smt=" = test one specific endpoint
LFITester.py -L test.txt = test a list of endpoints from file
LFITester.py -c -u "http://URL" = crawl and test all endpoints of that URL
LFITester.py -c -L test.txt = crawl and test all endpoints for every URL in the file
LFITester.py --creds abc:abc -u "http://URL?smt=" = test one specific endpoint which requires a login
Developers: Konstantinos Papanagnou (https://github.com/Konstantinos-Papanagnou)
Konstantinos Pantazis (https://github.com/kostas-pa)
Timothy Stowe (https://github.com/timothy90990)
• 基本用法：python3 LFITester.py -u "http://myvulnerabledomain/vulnerable/application?test_param="
• 如果你遇到带有 2 个查询参数的 URL 问题，例如 http://url?param1=1¶m2=2，请尝试用 "" 包裹它，如下所示 "http://url?param1=1¶m2=2"
• 如果你是普通用户并且遇到关于 Git 的错误，请尝试使用 sudo 命令运行 lfitester，如下所示 sudo lfitester [flags]
• 如果你遇到库相关的问题，请尝试运行 --update 标志，然后执行 sudo pip3 install -r requirements.txt，因为依赖项可能已更改
• 如果你在输出文件中看不到颜色，而是看到颜色代码，请搜索 [your text editor] display ANSI color codes。
• 如果 setup.sh 无法安装某个 python 包，请尝试使用命令 sudo pip3 install [package] 手动安装
• 如果它卡住了，就按回车，目前先这样 :)
• 如果你得到奇怪的编码结果，请尝试移除参数中的任何值，包括 Burp 文件。
• 如果你喜欢这个项目，请考虑给它一个 star
• 感谢所有贡献者协助我完成这个项目，以及他们提供的知识。