Attribute Error

[analyserdmz]

Hello, thank you for your project, it seems very promising.

I get the following error while trying to run it.

C:\tools\LFImap>python lfimap.py -U "http://testphp.vulnweb.com/showimage.php?file=php://filter/convert.base64-encode/resource=showimage.php" -C "asdasd" -a

Traceback (most recent call last):
  File "C:\tools\LFImap\lfimap.py", line 1799, in <module>
    main()
  File "C:\tools\LFImap\lfimap.py", line 1442, in main
    r,_ = REQUEST(url, headers, postTest, proxies, "test", "test")
  File "C:\tools\LFImap\lfimap.py", line 255, in REQUEST
    if(tOut is not None): res = requests.request(args.method, url, data=postData.encode("utf-8"), headers=headersData, proxies=proxy, verify=False, timeout=tOut)
  File "C:\Python310\lib\site-packages\requests\api.py", line 59, in request
    return session.request(method=method, url=url, **kwargs)
  File "C:\Python310\lib\site-packages\requests\sessions.py", line 562, in request
    method=method.upper(),
AttributeError: 'NoneType' object has no attribute 'upper'

I am using Python 3.10.6.

Any idea?

[hansmach1ne]

Hello, thank you for taking an interest in the LFImap.

The program for now will not do automatic parameter check. So the way to specify the parameter that you would want to test is with 'PWN' keyword. I am currently coding new features and am planning to implement automatic parameter recognition when user doesn't specify one.

To solve the issue try specifying the url as either: -U http://testphp.vulnweb.com/showimage.php?file=PWN -a or -U http://testphp.vulnweb.com/showimage.php?file=php://filter/convert.base64-encode/resource=PWN -t

If web app supports filter wrapper, it should find the vulnerability this way, as the base64 encoded '/etc/passwd' in response should be recognized by the tool.

Edit: I am pretty sure that website is no longer vulnerable to filter wrapper file read, because looks like they changed configuration. I recommend testing this on some other vulnerable application like DVWA, as vulnweb's file read vulnerability is created to be very limited to only a few files.

[hansmach1ne]

@analyserdmz Implemented automatic parameter recognition in the new commit https://github.com/hansmach1ne/LFImap/commit/a64cfbe8feff8a9a68404475115521b364e67b0d.

Could you please do a git pull and check if there are still any issues persisting?

[hansmach1ne]

I reopened this issue, because I noticed a few edge cases bugs with -R, -F modules. Will be fixing asap and test thoroughly new automatic parameter recognition feature, together with custom parameter specification with 'PWN'.