Find and exploit file inclusion and directory traversal flaws

fdsploit automates the search for and exploitation of file inclusion and path traversal bugs. Point it at a URL and it works through a payload set, adjusting depth and encoding, to find where an application reads attacker-controlled paths and then pulls back the files it can reach. It handles both GET and POST flows and can target a specific parameter.

It is built for the messy reality of these bugs. You can base64-encode or URL-encode payloads to slip past filters, add a null byte or other termination character to defeat extension appending, search responses for a keyword to confirm a hit, and even test for command execution through vulnerable PHP functions. A custom user-agent and session cookie keep requests looking legitimate.

On Trickest, fdsploit is a Vulnerabilities node that takes a URL or a file of URLs and writes a folder and a file. Run it after discovery and parameter mining have surfaced candidate endpoints, so it focuses its payloads on the parameters most likely to include files.