Skip to content

oaass/liffy

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

5 Commits
 
 
 
 
 
 
 
 
 
 
 
 

Repository files navigation

liffy

Liffy is a tool to exploit local file inclusion vulnerability using the built-in wrappers php://input, data://, and a process control extension called 'expect'.

Install

Liffy requires the following libraries: requests, argparse, blessings, urlparse

In order to host the payload you may use Node's HTTP server: https://github.com/nodeapps/http-server

Or you can simply spawn python's SimpleHTTPServer in /tmp on port 8000. Further development of the tool will eventually include spawning a built-in web server in order to download, for now you can adjust the location and port in the source code for your needs. These can be changed in core.py under the execute functions.

Example Usage

./liffy --url http://target/pdfs/vulnerable.php?= --data

About

Local File Inclusion Exploitation Tool

Resources

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published