Identify and exploit LFI, RFI, and path traversal vulnerabilities in web applications.
npx skills add https://github.com/Skobyn/talon --skill hunt-lfi-skobyn
Please help me install this Agent Skill. Skill: hunt-lfi Source: https://github.com/Skobyn/talon/tree/main/skills/hunt-lfi Command: npx skills add https://github.com/Skobyn/talon --skill hunt-lfi-skobyn
This Skill identifies and exploits vulnerabilities related to Local File Inclusion (LFI), Remote File Inclusion (RFI), and Path Traversal, enabling security researchers to uncover and mitigate potential risks.
Run the 'hunt-lfi' skill to scan the target application for LFI, RFI, and path traversal vulnerabilities.
High-intent search queries and answers about installing and using this skill.
To detect Local File Inclusion (LFI) and path traversal vulnerabilities during a security audit, you can use automated scanning techniques that identify and confirm unauthorized file access points in web applications. This Skill automates that discovery process for security researchers.
Yes, exploiting Remote File Inclusion (RFI) vulnerabilities requires specific tools to be installed in your environment. You need gf, ffuf, wfuzz, and Burp Collaborator to confirm and execute remote code inclusion during red team engagements.
The best way to automate path traversal discovery for red team engagements is by running a dedicated vulnerability detection Skill. It leverages tools like gf and ffuzz to discover and leverage unauthorized directory traversal paths automatically.
Yes, you can use Burp Collaborator to confirm Remote File Inclusion (RFI) vulnerabilities. It acts as a dependency for validating out-of-band interactions when the Skill exploits RFI vulnerabilities to execute remote code.
LFI vulnerability detection works with fuzzing tools like wfuzz and ffuf by systematically injecting path traversal payloads into web application parameters. These tools automate the discovery and confirmation of unauthorized local file access points.
Limitations when scanning for path traversal and LFI vulnerabilities depend on the target web application's input validation filters. Complex encoding bypasses may require manual intervention beyond the automated detection capabilities of gf and ffuf.
zebbernIdentifies and exploits file path traversal vulnerabilities in web applications.
sseshachalaDetect and exploit LFI/RFI and path traversal flaws to read files or achieve RCE.
blacklanternsecurityDiscover web application injection points and test for common vulnerability classes.
ClearMeasureLabsScan .NET and npm dependencies for disclosed CVEs and generate consolidated security reports.
