View Single Post
  #1  
Old 02-18-2025, 11:18 PM

Vipgift19 Vipgift19 is offline
Join Date: Mar 2024
Posts: 0
Default


This one-liner will allow you to find LFI vulnerabilities on multiple URLs. Utilizing 'paramspider' to collect URL parameters from web archives, importing them to 'ffuf' for fuzzing while using an external wordlist dictionary.
The following tools are required:
https://github.com/devanshbatham/ParamSpider
https://github.com/ffuf/ffuf

Example:
python3 paramspider.py -d testphp.vulnweb.com -o urls.txt | for URL in $(</root/Tools/ParamSpider/output/urls.txt); do (ffuf -u "$<URL}" -c -w /root/FUZZB/SecLists/sts/Fuzzing/LFI/LFI-Jhaddix.txt -ac); done