security enabled verified high v1.0.0

lfi-suite

Local File Inclusion exploitation suite that automates LFI detection, file reading, RCE via log poisoning, and PHP wrapper attacks.

📋 Live Preview

python3 lfi.py {flag-type} {flag-os-cmd} {flag-read-file} {flag-shell} {flag-proxy} -t {target}

📎 flag-type 📎 flag-os-cmd 📎 flag-read-file 📎 flag-shell 📎 flag-proxy 📎 target

python3 lfi.py {flag-type} {flag-os-cmd} {flag-read-file} {flag-shell} {flag-proxy} -t {target}

Sandbox: execFile · Timeout: 120s

Capabilities

web.lfi.scan

web.lfi.exploit

web.lfi.rce

web.lfi.read-file

web.lfi.php-wrapper

Parameters

Name	Type	Required	Default	Description	Aliases
`target`	string	Yes	-	Target URL	`-t`, `--target`
`flag-type`	string	No	-	Exploit type (basic, expect, input, enc, etc.)	`--type`
`flag-os-cmd`	string	No	-	OS command to execute	`--os-cmd`
`flag-read-file`	string	No	-	File to read on remote system	`--read-file`
`flag-shell`	boolean	No	-	Interactive shell mode	`--shell`
`flag-proxy`	string	No	-	HTTP proxy	`--proxy`

Artifacts

Type	Description	MIME	Schema	Trust
`web.lfi.output`	LFI exploitation results	text/plain	-	verified
`web.lfi.shell`	Remote shell access	text/plain	-	verified

Contract

Inputs

web.target.url

Target URL with file parameter

Outputs

web.lfi.output

File content or command output

Side effects: network_trafficfilesystem_write

Workflow Edges

Produces

web.lfi.output

Consumes

web.target.url

Resource Profile

Resource	Value
CPU	low
Memory	64 MB
Network	low
Disk I/O	low

Examples

Basic LFI scan

python3 lfi.py -t "http://example.com/page.php?file=test"

Execute command on target

python3 lfi.py -t "http://example.com/page.php?file=test" --os-cmd "id"

Interactive shell

python3 lfi.py -t "http://example.com/page.php?file=test" --shell

Documentation

LFI Suite — Local File Inclusion Exploitation Suite

LFI Suite is a Python-based tool for detecting and exploiting Local File Inclusion vulnerabilities. It supports multiple PHP wrapper techniques, log poisoning for RCE, reverse shell generation, and automated exploitation.

Usage

# Basic scan
python3 lfi.py -t "http://target.com/page.php?file=test"

# Execute command
python3 lfi.py -t "http://target.com/page.php?file=test" --os-cmd "id"

# Interactive shell
python3 lfi.py -t "http://target.com/page.php?file=test" --shell

# Read specific file
python3 lfi.py -t "http://target.com/page.php?file=test" --read-file /etc/passwd

Dependencies

python3

Related Tools

kadimuscommixtplmap

References

LFI Suite GitHub