Vulnerabilities
Probe LFI, RFI, and path traversal on candidate URLs
Automate Local/Remote File Inclusion and directory traversal checks.
overview
What fdsploit does
You have candidate endpoints where a parameter may read a path. Point fdsploit at --url (or --file for a list), set --verb and --params for POST, and let it walk inclusion and traversal payloads up to --depth.
Confirm with --keyword in the response body. Encode with --b64 or -e, append --tchar (%00 or ?) when the app forces an extension, and pass --cmd when you need to check PHP command execution through a vulnerable include.
Reach for nuclei when you want broad template coverage. Use sqlmap for SQL injection. fdsploit stays on file inclusion and traversal; the managed node writes a folder and a file of confirmed findings.
use cases
Where fdsploit fits
Automate LFI and directory traversal testing
Run fdsploit against a candidate URL so it works through inclusion and traversal payloads automatically and reports which paths it can read.
Bypass filters with encoding and null bytes
Apply base64 or URL encoding and a termination character so payloads slip past naive input filters and extension-appending logic.
Confirm a hit with a keyword
Search responses for a known string so a successful inclusion is confirmed by content rather than guessed from status codes.
Probe file inclusion for command execution
Use the command option to test whether a vulnerable PHP function turns file inclusion into remote command execution.
reference
fdsploit inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| url | STRING | --url | Target URL to test. |
| target-urls | FILE | --file | File containing URLs to test. |
| param | STRING | --params | POST parameters to use (param1:value1,param2:value2,...). |
| request-type | STRING | --verb | Request type, GET or POST (default GET). |
| depth | STRING | --depth | Maximum traversal depth for the payload (default 5). |
| keyword | STRING | --keyword | Search for a keyword in the response to confirm success. |
| cmd-to-execute | STRING | --cmd | Test for command execution through vulnerable PHP functions. |
| termination-character | STRING | --tchar | Termination character ('%00' or '?') to defeat extension appending. |
Showing key inputs. fdsploit exposes 13 inputs in total.
Full flag reference (13 inputs)
| Name | Type | Flag | Description |
|---|---|---|---|
| url | STRING | --url | Target URL to test. |
| depth | STRING | --depth | Maximum traversal depth for the payload (default 5). |
| param | STRING | --params | POST parameters to use, as param1:value1,param2:value2 (POST requests only). |
| keyword | STRING | --keyword | Keyword to search for in the response to confirm a hit (default none). |
| payload | STRING | --payload | Payload file of paths to look for. |
| b64-encode | BOOLEAN | --b64 | Base64-encode the payload (default false). |
| url-encode | STRING | -e | URL-encode the payload (default false). |
| user-agent | STRING | --useragent | Use a random user-agent (default FDsploit_1.2_agent). |
| target-urls | FILE | --file | File containing URLs to test. |
| request-type | STRING | --verb | Request type, GET or POST (default GET). |
| cmd-to-execute | STRING | --cmd | Command to test for execution through vulnerable PHP functions (default none). |
| specify-cookie | STRING | --cookie | Session cookie to send with each request (default none). |
| termination-character | STRING | --tchar | Termination character ('%00' or '?') to defeat extension appending (default none). |
example
Run fdsploit
# automated LFI/traversal test, confirm the hit with a keywordFDsploit.py --url "http://example.com/index.php?page=home" --depth 6 --keyword "root:x:" --tchar '%00'[i] Analysing url: http://example.com/index.php?page=home[i] Testing LFI/traversal payloads (max depth: 6) ...[+] LFI found -> page=../../../../../../etc/passwd%00[+] Keyword 'root:x:' matched in responseroot:x:0:0:root:/root:/bin/bashdaemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologinwww-data:x:33:33:www-data:/var/www:/usr/sbin/nologin[i] Results saved to output/example.com/guidance
Choosing fdsploit
Run fdsploit after discovery and parameter mining surface inclusion candidates. Prefer nuclei for broad vuln templates; use sqlmap for SQLi; keep fdsploit for LFI, RFI, and traversal depth.
tplmap
Server-side template injection automation. Same exploit-class step, different injection family.
commix
Command-injection discovery and exploitation. Overlaps only where fdsploit probes PHP command execution via --cmd.
nuclei
Broad template coverage across many issue types. fdsploit goes deeper on inclusion and traversal specifically.
faq
fdsploit questions
related
More Vulnerabilities tools
agentsleak
Black Hat Arsenal runtime security for AI coding agents, evaluated offline over recorded action events.
commix
Automates OS command injection detection and exploitation.
dalfox
Parameter mining and XSS testing with headless verification.
dnsreaper
Subdomain takeover scanner with cloud-zone intake.
find-gh-poc
Locate public CVE proof-of-concept repositories on GitHub.
golemhalt
Black Hat Arsenal reference monitor for coding agents, inventoried as a policy and provider corpus.
Run fdsploit yourself
A list of candidate URLs feeds fdsploit, which tests file-inclusion and traversal payloads and writes the confirmed findings as output.
Facts on this page come from the live Trickest tool library.