Attribute Error about lfimap HOT 3 CLOSED

Hello, thank you for taking an interest in the LFImap.

The program for now will not do automatic parameter check. So the way to specify the parameter that you would want to test is with 'PWN' keyword. I am currently coding new features and am planning to implement automatic parameter recognition when user doesn't specify one.

To solve the issue try specifying the url as either:
-U http://testphp.vulnweb.com/showimage.php?file=PWN -a
or
-U http://testphp.vulnweb.com/showimage.php?file=php://filter/convert.base64-encode/resource=PWN -t

If web app supports filter wrapper, it should find the vulnerability this way, as the base64 encoded '/etc/passwd' in response should be recognized by the tool.

Edit: I am pretty sure that website is no longer vulnerable to filter wrapper file read, because looks like they changed configuration. I recommend testing this on some other vulnerable application like DVWA, as vulnweb's file read vulnerability is created to be very limited to only a few files.

from lfimap.

@analyserdmz Implemented automatic parameter recognition in the new commit a64cfbe.

Could you please do a git pull and check if there are still any issues persisting?

from lfimap.

I reopened this issue, because I noticed a few edge cases bugs with -R, -F modules. Will be fixing asap and test thoroughly new automatic parameter recognition feature, together with custom parameter specification with 'PWN'.

from lfimap.