How do I get payloads past input filters?

Use --b64 for base64 encoding or -e to URL-encode the payload, and add --tchar with %00 or ? to defeat extension-appending logic.

How do I confirm a successful inclusion?

Set --keyword to a string you expect in the target file, for example root:x: when reading /etc/passwd. A hit is content-matched, not guessed from status codes.

Can it test POST parameters and a URL list?

Yes. Set --verb POST with --params as param1:value1,param2:value2, and use --file for a list of candidate URLs instead of a single --url.

Updated Jul 14, 2026

Vulnerabilities

Probe LFI, RFI, and path traversal on candidate URLs

Q: Can fdsploit test for PHP command execution?

Yes. Pass --cmd with a command and it checks whether a vulnerable PHP function turns file inclusion into remote command execution.

Automate Local/Remote File Inclusion and directory traversal checks.

Automate LFI and directory traversal testing Bypass filters with encoding and null bytes Confirm a hit with a keyword

overview

What fdsploit does

You have candidate endpoints where a parameter may read a path. Point fdsploit at --url (or --file for a list), set --verb and --params for POST, and let it walk inclusion and traversal payloads up to --depth.

Confirm with --keyword in the response body. Encode with --b64 or -e, append --tchar (%00 or ?) when the app forces an extension, and pass --cmd when you need to check PHP command execution through a vulnerable include.

Reach for nuclei when you want broad template coverage. Use sqlmap for SQL injection. fdsploit stays on file inclusion and traversal; the managed node writes a folder and a file of confirmed findings.

source github.com/chrispetrou/FDsploit

use cases

Where fdsploit fits

Automate LFI and directory traversal testing

Run fdsploit against a candidate URL so it works through inclusion and traversal payloads automatically and reports which paths it can read.

Bypass filters with encoding and null bytes

Apply base64 or URL encoding and a termination character so payloads slip past naive input filters and extension-appending logic.

Confirm a hit with a keyword

Search responses for a known string so a successful inclusion is confirmed by content rather than guessed from status codes.

Probe file inclusion for command execution

Use the command option to test whether a vulnerable PHP function turns file inclusion into remote command execution.

reference

fdsploit inputs and flags

13 inputs

Name	Type	Flag	Description
url	STRING	--url	Target URL to test.
target-urls	FILE	--file	File containing URLs to test.
param	STRING	--params	POST parameters to use (param1:value1,param2:value2,...).
request-type	STRING	--verb	Request type, GET or POST (default GET).
depth	STRING	--depth	Maximum traversal depth for the payload (default 5).
keyword	STRING	--keyword	Search for a keyword in the response to confirm success.
cmd-to-execute	STRING	--cmd	Test for command execution through vulnerable PHP functions.
termination-character	STRING	--tchar	Termination character ('%00' or '?') to defeat extension appending.

Showing key inputs. fdsploit exposes 13 inputs in total.

Full flag reference (13 inputs)

Name	Type	Flag	Description
url	STRING	--url	Target URL to test.
depth	STRING	--depth	Maximum traversal depth for the payload (default 5).
param	STRING	--params	POST parameters to use, as param1:value1,param2:value2 (POST requests only).
keyword	STRING	--keyword	Keyword to search for in the response to confirm a hit (default none).
payload	STRING	--payload	Payload file of paths to look for.
b64-encode	BOOLEAN	--b64	Base64-encode the payload (default false).
url-encode	STRING	-e	URL-encode the payload (default false).
user-agent	STRING	--useragent	Use a random user-agent (default FDsploit_1.2_agent).
target-urls	FILE	--file	File containing URLs to test.
request-type	STRING	--verb	Request type, GET or POST (default GET).
cmd-to-execute	STRING	--cmd	Command to test for execution through vulnerable PHP functions (default none).
specify-cookie	STRING	--cookie	Session cookie to send with each request (default none).
termination-character	STRING	--tchar	Termination character ('%00' or '?') to defeat extension appending (default none).

example

Run fdsploit

fdsploit · command

# automated LFI/traversal test, confirm the hit with a keywordFDsploit.py --url "http://example.com/index.php?page=home" --depth 6 --keyword "root:x:" --tchar '%00'

sample output

[i] Analysing url: http://example.com/index.php?page=home[i] Testing LFI/traversal payloads (max depth: 6) ...[+] LFI found -> page=../../../../../../etc/passwd%00[+] Keyword 'root:x:' matched in responseroot:x:0:0:root:/root:/bin/bashdaemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologinwww-data:x:33:33:www-data:/var/www:/usr/sbin/nologin[i] Results saved to output/example.com/

guidance

Choosing fdsploit

Run fdsploit after discovery and parameter mining surface inclusion candidates. Prefer nuclei for broad vuln templates; use sqlmap for SQLi; keep fdsploit for LFI, RFI, and traversal depth.

tplmap

Server-side template injection automation. Same exploit-class step, different injection family.

commix

Command-injection discovery and exploitation. Overlaps only where fdsploit probes PHP command execution via --cmd.

nuclei

Broad template coverage across many issue types. fdsploit goes deeper on inclusion and traversal specifically.

faq

fdsploit questions

Yes. It walks traversal payloads at increasing --depth alongside Local and Remote File Inclusion tests, then reports paths it can read.

Run fdsploit yourself

A list of candidate URLs feeds fdsploit, which tests file-inclusion and traversal payloads and writes the confirmed findings as output.

Run fdsploit in Trickest View the workflow

Facts on this page come from the live Trickest tool library.

Name

Type

Flag

Description

url

STRING

--url

Target URL to test.

target-urls

FILE

--file

File containing URLs to test.

param

STRING

--params

POST parameters to use (param1:value1,param2:value2,...).

request-type

STRING

--verb

Request type, GET or POST (default GET).

depth

STRING

--depth

Maximum traversal depth for the payload (default 5).

keyword

STRING

--keyword

Search for a keyword in the response to confirm success.

cmd-to-execute

STRING

--cmd

Test for command execution through vulnerable PHP functions.

termination-character

STRING

--tchar

Termination character ('%00' or '?') to defeat extension appending.

Name

Type

Flag

Description

url

STRING

--url

Target URL to test.

depth

STRING

--depth

Maximum traversal depth for the payload (default 5).

param

STRING

--params

POST parameters to use, as param1:value1,param2:value2 (POST requests only).

keyword

STRING

--keyword

Keyword to search for in the response to confirm a hit (default none).

payload

STRING

--payload

Payload file of paths to look for.

b64-encode

BOOLEAN

--b64

Base64-encode the payload (default false).

url-encode

STRING

-e

URL-encode the payload (default false).

user-agent

STRING

--useragent

Use a random user-agent (default FDsploit_1.2_agent).

target-urls

FILE

--file

File containing URLs to test.

request-type

STRING

--verb

Request type, GET or POST (default GET).

cmd-to-execute

STRING

--cmd

Command to test for execution through vulnerable PHP functions (default none).

specify-cookie

STRING

--cookie

Session cookie to send with each request (default none).

termination-character

STRING

--tchar

Termination character ('%00' or '?') to defeat extension appending (default none).

[i] Analysing url: http://example.com/index.php?page=home[i] Testing LFI/traversal payloads (max depth: 6) ...[+] LFI found -> page=../../../../../../etc/passwd%00[+] Keyword 'root:x:' matched in responseroot:x:0:0:root:/root:/bin/bashdaemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologinwww-data:x:33:33:www-data:/var/www:/usr/sbin/nologin[i] Results saved to output/example.com/

Probe LFI, RFI, and path traversal on candidate URLs

What fdsploit does

Where fdsploit fits

Automate LFI and directory traversal testing

Bypass filters with encoding and null bytes

Confirm a hit with a keyword

Probe file inclusion for command execution

fdsploit inputs and flags

Run fdsploit

Choosing fdsploit

tplmap

commix

nuclei

fdsploit questions

More Vulnerabilities tools

commix

dnsreaper

find-gh-poc

jwt-tool

kxss

sqlmap

Run fdsploit yourself

Probe LFI, RFI, and path traversal on candidate URLs

What fdsploit does

Where fdsploit fits

Automate LFI and directory traversal testing

Bypass filters with encoding and null bytes

Confirm a hit with a keyword

Probe file inclusion for command execution

fdsploit inputs and flags

Run fdsploit

Choosing fdsploit

tplmap

commix

nuclei

fdsploit questions

More Vulnerabilities tools

commix

dnsreaper

find-gh-poc

jwt-tool

kxss

sqlmap

Run fdsploit yourself