30 September 2010 | 6,905 views

inspathx – Tool For Finding Path Disclosure Vulnerabilities

Check For Vulnerabilities with Acunetix

inspathx is a tool that uses local source tree to make requests to the URL and searches for path inclusion (Full Path Disclosure) error messages. It’s a very common problem in PHP web applications that crops up a lot.

PHP Web application developers sometimes fail to add safety checks against authentications, file inclusion etc and are prone to reveal possible sensitive information when those applications URLs are directly requested. Sometimes, it’s a clue to Local File Inclusion (LFI) vulnerability. For open-source applications, source code can be downloaded and checked to find such information.

This script will do this job.

  1. First you have to download source archived file of your desired OSS.
  2. Second, extract it.
  3. Third, feed its path to inspath

inspathx accepts the following arguments:

  • -d or –dir argument as source directory (of application)
  • -u or –url arguement as the target base URL (like http://victim.com)
  • -t or –threads argument as the number of threads concurrently to run (default is 10)

You can download inspathx via SVN here:

Or read more here.

Advertisements



Recent in Hacking Tools:
- Mimikatz – Gather Windows Credentials
- Dharma – Generation-based Context-free Grammar Fuzzing Tool
- Passgen – Random Character Generator For WPA/WPA2 Key Cracking

Related Posts:
- LFIMAP – Scan For Files Vulnerable To LFI (Local File Inclusion)
- Microsoft Implements Company Policy For Vulnerability Disclosure
- Month of Browser Bugs (MoBB)

Most Read in Hacking Tools:
  • Top 15 Security/Hacking Tools & Utilities - 1,923,916 views
  • Brutus Password Cracker – Download brutus-aet2.zip AET2 - 1,209,565 views
  • wwwhack 1.9 – Download wwwhack19.zip Web Hacking Tool - 650,852 views


  • Advertise on Darknet

    One Response to “inspathx – Tool For Finding Path Disclosure Vulnerabilities”

    1. yehgbot 12 October 2010 at 3:55 pm Permalink

      It’s been updated today with added syntax and language support. Update @ svn checkout http://inspathx.googlecode.com/svn/trunk/ inspathx-read-only