search

hansmach1ne / LFImap

Local File Inclusion discovery and exploitation tool
Apache License 2.0
197 stars 29 forks source link

Not clear instructions #36

Closed mastercho closed 1 year ago

mastercho commented 1 year ago

Not clear how to use long.txt wordlist instead of short.txt, can you add it to instructions?

Also need some bypass techniques for waf like urlencode

hansmach1ne commented 1 year ago

Hey, Thank you for taking an interest in Lfimap.

If you want to use long.txt wordlist it comes as a part of the project inside wordlists/long.txt. For specifying and using it you can use: -wT wordlists/long.txt, but make sure you are using -t (truncation module), or -a (all modules) that would consume it.

The final command would look similar to the following: python3 lfimap.py -U "http://url/?vulnparam=PWN" -t -v -wT wordlists/long.txt

Regarding WAF, long.txt has much more payloads inside and there are better chances that one of those will work. Hopefully this helps, if you have any more issues with the code, let me know I will try to improve it.

mastercho commented 1 year ago

Thank you for clarification and indeed long.txt bypasses waf, what i mean it to pass it like param so if is ../../../ to encode it into ..%252f..%252f..%252f..%252f but then if wordlist have it would not be good fit, for now will adds records into list thanks again

hansmach1ne commented 1 year ago

No problem, glad I could help!

hansmach1ne commented 1 year ago

@mastercho Check new commit, added '--use-long ' switch, that will automatically select long.txt, without having to search for it.

mastercho commented 1 year ago

thats perfect thanks