Fuzz directory traversal and LFI vulnerabilities across HTTP, FTP, and TFTP services.
npx skills add https://github.com/AeonDave/malskill --skill dotdotpwn
Please help me install this Agent Skill. Skill: dotdotpwn Source: https://github.com/AeonDave/malskill/tree/main/offensive-tools/web-app/dotdotpwn Command: npx skills add https://github.com/AeonDave/malskill --skill dotdotpwn
This Skill helps identify and test for directory traversal vulnerabilities in web applications and services, a common security flaw that can expose sensitive files.
/etc/passwd.Use the dotdotpwn skill to fuzz the target website example.com on port 80 for directory traversal vulnerabilities.
High-intent search queries and answers about installing and using this skill.
This Skill performs directory traversal fuzzing against web servers and applications to identify path traversal and LFI vulnerabilities. It automatically tests targets to see if attackers can access sensitive files like /etc/passwd outside the intended web root.
Directory traversal fuzzing supports HTTP, FTP, and TFTP services. This allows you to test multiple protocols for Local File Inclusion (LFI) and path traversal vulnerabilities across different network services during a security audit.
Local File Inclusion (LFI) testing checks whether a web application can be tricked into exposing sensitive server files. You need it during security audits to ensure attackers cannot access files outside the intended web root, such as /etc/passwd.
Yes, you need Perl installed on your Linux or macOS system to use this fuzzing tool. The Skill requires compatibility with Perl and the apt installation of the dotdotpwn utility to perform directory traversal tests.
This fuzzing approach targets path traversal and LFI vulnerabilities across HTTP, FTP, and TFTP services. It is designed for standard security audits on web servers and applications, but may have limitations with highly customized non-standard implementations.
BaoNguyen09Install Node.js and project dependencies on macOS for development.
EntroVyxExtract credentials, server paths, and database schemas from exposed PHP error logs.
ricardoo022Identify configurations, secrets, and attack-surface exposure from JS-bundled web applications.
salmanabdurrahmanTest input parameters for directory escape sequences and encoding bypasses.