https://github.com/rix4uni/lfifinder

A fast and efficient Local File Inclusion (LFI) vulnerability scanner written in Go. This tool automates the process of testing URLs for LFI vulnerabilities by replacing parameter values with payloads and checking responses.
https://github.com/rix4uni/lfifinder

Last synced: 24 days ago
JSON representation

Host: GitHub
URL: https://github.com/rix4uni/lfifinder
Owner: rix4uni
Created: 2025-12-08T18:48:41.000Z (8 months ago)
Default Branch: main
Last Pushed: 2025-12-09T05:16:15.000Z (8 months ago)
Last Synced: 2026-02-14T02:25:56.204Z (6 months ago)
Language: Go
Size: 9.77 KB
Stars: 3
Watchers: 0
Forks: 1
Open Issues: 0
Metadata Files:
- Readme: README.md

Awesome Lists containing this project

README

## LFIFinder

## Features

- 🔍 **Automatic LFI Testing**: Tests URLs with multiple payloads to detect LFI vulnerabilities
- 🚀 **Concurrent Scanning**: Process multiple URLs in parallel for faster results
- 🎨 **Colored Output**: Color-coded results (Red for VULNERABLE, Green for NOT VULNERABLE)
- 📦 **Auto-Download Payloads**: Automatically downloads default payloads on first run
- 🔄 **URL Filtering**: Automatically filters URLs using `urldedupe`, `grep`, and `egrep`
- 🌐 **URL-Encoded Support**: Handles both `=` and `%3D` (URL-encoded equals) in parameters
- ⚡ **Configurable**: Customizable timeout, concurrency, and output options
- 📝 **Flexible Payloads**: Use single payload, comma-separated payloads, or payload file
- ♻️ **Crash-Safe Resume**: Default-on resume with `resume.cfg`; use `--no-resume` to start fresh

## Installation

### Prerequisites
```
git clone https://github.com/ameenmaali/urldedupe.git --depth 1 &>/dev/null && cd urldedupe && cmake CMakeLists.txt &>/dev/null && make &>/dev/null && mv urldedupe /usr/local/bin/ && cd .. && rm -rf urldedupe
```

## Installation
### Install via Go
```
go install github.com/rix4uni/lfifinder@latest
```

### Download Prebuilt Binaries
```
wget https://github.com/rix4uni/lfifinder/releases/download/v0.0.3/lfifinder-linux-amd64-0.0.3.tgz
tar -xvzf lfifinder-linux-amd64-0.0.3.tgz
rm -rf lfifinder-linux-amd64-0.0.3.tgz
mv lfifinder ~/go/bin/lfifinder
```

Or download the [latest release](https://github.com/rix4uni/lfifinder/releases) for your platform.

### Compile from Source
```
git clone --depth 1 https://github.com/rix4uni/lfifinder.git
cd lfifinder; go install
```

## Usage

### Basic Usage

```yaml
# Test a single URL
echo "https://example.com/page?file=test" | lfifinder

# Test multiple URLs from a file
cat urls.txt | lfifinder

# With custom single payload
cat urls.txt | lfifinder -p "/etc/passwd"

# With comma-separated payloads
cat urls.txt | lfifinder -p "/etc/passwd, ../etc/passwd"

# With custom payloads file
cat urls.txt | lfifinder -p payloads.txt
```

### Command-Line Flags

| Flag | Short | Description | Default |
|------|------|-------------|---------|
| `--payload` | `-p` | Payload(s) to use: single (`"/etc/passwd"`), comma-separated (`"/etc/passwd, ../etc/passwd"`), or file path (`payloads.txt`) | `~/.config/lfifinder/payloads.txt` |
| `--timeout` | | HTTP request timeout in seconds | `30` |
| `--concurrent` | | Number of concurrent URL scans | `50` |
| `--vuln` | | Show only VULNERABLE URLs | `false` |
| `--silent` | | Silent mode (suppress banner) | `false` |
| `--version` | | Print version and exit | `false` |
| `--nc` | | Disable colored output | `false` |
| `--verbose` | | Show verbose output (download messages, etc.) | `false` |
| `--no-resume` | | Disable resume; start scanning fresh and ignore any existing `resume.cfg` | `false` |

### Examples

#### Test with default settings
```yaml
cat urls.txt | lfifinder
```

#### Test with custom timeout and concurrency
```yaml
cat urls.txt | lfifinder --timeout 60 --concurrent 100
```

#### Start fresh without resuming
```yaml
cat urls.txt | lfifinder --no-resume
```

#### Show only vulnerable URLs
```yaml
cat urls.txt | lfifinder --vuln
```

#### Silent mode with no colors
```yaml
cat urls.txt | lfifinder --silent --nc
```

#### Custom single payload
```yaml
cat urls.txt | lfifinder -p "/etc/passwd"
```

#### Multiple comma-separated payloads
```yaml
cat urls.txt | lfifinder -p "/etc/passwd, ../etc/passwd"
```

#### Custom payloads file
```yaml
cat urls.txt | lfifinder -p /path/to/custom-payloads.txt
```

#### Verbose mode (shows download messages)
```yaml
cat urls.txt | lfifinder --verbose
```

## How It Works

1. **URL Input**: Reads URLs from stdin (supports both `echo` and `cat`)

2. **URL Filtering**: Automatically filters URLs using:
```yaml
urldedupe -s | grep -aE '=|%3D' | egrep -aiv '.(jpg|jpeg|gif|css|tif|tiff|png|ttf|woff|woff2|icon|pdf|svg|txt|js)'
```
- Deduplicates URLs
- Filters URLs containing `=` or `%3D` (URL-encoded equals)
- Excludes URLs with static file extensions

3. **Payload Testing**: For each URL:
- Replaces all parameter values with each payload from the wordlist
- Handles both `=` and `%3D` separators
- Makes HTTP GET requests with modified URLs
- Checks response body for the pattern `root:[x*]:0:0` (indicating `/etc/passwd` content)

4. **Output**: Displays results:
- **VULNERABLE**: Red colored output when LFI vulnerability is detected
- **NOT VULNERABLE**: Green colored output when no vulnerability is found

## Default Payloads

On first run, if no `-p` flag is provided, the tool automatically:
- Creates `~/.config/lfifinder/` directory
- Downloads default payloads from: `https://raw.githubusercontent.com/rix4uni/WordList/refs/heads/main/payloads/lfi/lfi-medium.txt`
- Saves them as `~/.config/lfifinder/payloads.txt`

You can override the default payloads using the `--payload` flag with:
- Single payload: `-p "/etc/passwd"`
- Multiple payloads: `-p "/etc/passwd, ../etc/passwd"`
- Payload file: `-p payloads.txt`

Use `--verbose` flag to see download messages.

## Output Format

### Colored Output (Default)
```yaml
VULNERABLE: https://example.com/page?file=/etc/passwd
NOT VULNERABLE: https://example.com/page?file=test
```

### No Color Output (`--nc` flag)
```yaml
VULNERABLE: https://example.com/page?file=/etc/passwd
NOT VULNERABLE: https://example.com/page?file=test
```

## URL Parameter Handling

The tool supports both standard and URL-encoded parameter separators:
- Standard: `?file=value`
- URL-encoded: `?file%3Dvalue`

Both formats are automatically detected and tested.

## Vulnerability Detection

The tool detects LFI vulnerabilities by checking HTTP responses for the pattern:
```yaml
root:[x*]:0:0
```

This pattern indicates that `/etc/passwd` content is being returned, confirming an LFI vulnerability.

## Performance

- **Concurrent Processing**: By default, processes 50 URLs concurrently
- **Configurable Concurrency**: Adjust with `--concurrent` flag
- **Timeout Control**: Configurable HTTP timeout with `--timeout` flag

## Resume Functionality

When scanning from a list (stdin), resume is enabled by default. Progress is saved after each host to a `resume.cfg` file in the current directory in statistics format:

```
scanned=300000
```

If a scan is interrupted (e.g., CTRL+C, terminal closed, system restart), re-run the same command in the same directory to automatically resume. The scanner skips the first `scanned` items from the post-filtered input stream and continues.

- To start fresh, use `--no-resume`.
- On successful completion, `resume.cfg` is deleted automatically.

The resume counter is defined over the post-filtered stream (after `urldedupe`/`grep`), so resuming requires running the same command again to reproduce the same filtered order.

## Interrupt Handling

The scanner responds immediately to the first CTRL+C:

- Pending tasks are cancelled gracefully
- Resume statistics are saved before exiting
- A helpful message is printed indicating how to resume

To resume an interrupted scan, simply run the same command again in the same directory. The scanner will continue from where it left off. The resume file is automatically deleted after successful completion.

ecosyste.ms

Data

Tools

Indexes

Applications

Experiments

Awesome

https://github.com/rix4uni/lfifinder

Awesome Lists containing this project

README