Skip to content
LFI/RFI scanner by Iman Karim (
Branch: master
Clone or download
Latest commit 089d225 Jul 2, 2015
Type Name Latest commit message Commit time
Failed to load latest commit information.
nbproject first commit Jul 3, 2015
plugins first commit Jul 3, 2015
src first commit Jul 3, 2015
LICENSE first commit Jul 3, 2015 first commit Jul 3, 2015

Welcome to the fimap project!

fimap is a little python tool which can find, prepare, audit, exploit and even google automaticly for local and remote file inclusion bugs in webapps. fimap should be something like sqlmap just for LFI/RFI bugs instead of sql injection. It's currently under heavy development but it's usable.

The goal of fimap is to improve the quality and security of your website.

Do not use this tool on servers where you don't have permission to pentest!

I am dead serious.

Find fimap on twitter:

Quick News for SVN and upcoming versions

fimap Features

  • Check a Single URL, List of URLs, or Google results fully automaticly.
  • Can identify and exploit file inclusion bugs.
  • Relative\Absolute Path Handling.
  • Tries automaticly to eleminate suffixes with Nullbyte and other methods like Dot-Truncation.
  • Remotefile Injection.
  • Logfile Injection.
  • Test and exploit multiple bugs:
  • include()
  • include_once()
  • require()
  • require_once()
  • You always define absolute pathnames in the configs. No monkey like redundant pathes like:
  • ../etc/passwd
  • ../../etc/passwd
  • ../../../etc/passwd
  • Has a Blind Mode (--enable-blind) for cases when the server has disabled error messages.
  • Has an interactive exploit mode which...
  • ...can spawn a shell on vulnerable systems.
  • ...can spawn a reverse shell on vulnerable systems.
  • ...can do anything you can imagine through it's plugin interface.
  • Add your own payloads and pathes to the xml files or go ahead and write a new plugin.
  • Has a Harvest mode which can collect URLs from a given domain for later pentesting.
  • Works also on windows.
  • Can handle directories in RFI mode like:
  • where Null-Byte and the '?' trick is not possible.
  • Can use proxys.
  • Scans and exploits GET, POST and Cookies.
  • Has a very small footprint. (No senseless bruteforcing of pathes - unless you need it.)
  • Can attack also windows servers!
  • Has a tiny plugin interface for writing exploitmode plugins
  • Non Interactive Exploiting

What doesn't work yet?

  • Other languages than PHP (even if engine is ready for others as well.)

Is there a How To?

  • Check out this post by HR from Kaotic Creations which explains fimap really good :) It's a tutorial for windows but I think unix heads should understand it as well.


You can’t perform that action at this time.