Navigation



FIS [File Inclusion Scanner] v0.1 – PHP Vulnerability

Last updated: June 18, 2010 | 17,655 views

A useful tool for anyone working with PHP applications.

DESCRIPTION
————
FIS (File Inclusion Scanner) is a vulnerability scanner for PHP applications. Is scans PHP files mapping PHP/HTTP variables and then performs a security audit,in order to find out which of them are exploitable.

USAGE
——
php fis.php [local file] [remote file] [remote FIS ID file]

[local file]
————–
The local copy of the PHP source file used by FIS to map the variables for the audit.

[remote file]
————–
The remote copy of the source executed by a remote webserver, the file we will audit.

[remote FIS ID file]
———————-
The FIS ID file is used to check whether a variable is exploitable or not. It contains PHP code that simply echoes a unique MD5 hash used for identification.

INTENDED AUDIENCE
——————
FIS is intended to be used by penetration testers, not script kidies nor malicious users. It creates a lot of noise on the remote host and can be easily discovered with a simple glance at
the webserver logs, which makes it useless as a cracking tool.

FEATURES
———
FIS, currently, supports audits using only GET requests. COOKIE & POST support is not yet implemented.

LOGGING
———
FIS automatically logs extra audit information in “fis.log” in the working directory.

FIS Website

You can download FIS directly here.

Share
Tweet
Share
Buffer
WhatsApp
Email
0 Shares
Posted in: Countermeasures, Security Software, Web Hacking

,


Latest Posts:


Arcane - Tool To Backdoor iOS Packages (iPhone ARM) Arcane – Tool To Backdoor iOS Packages (iPhone ARM)
Arcane is a simple script tool to backdoor iOS packages (iPhone ARM) and create the necessary resources for APT repositories.
August 17, 2020 - 205 Shares
SharpHose - Asynchronous Password Spraying Tool SharpHose – Asynchronous Password Spraying Tool
SharpHose is an asynchronous password spraying tool in C# for Windows environments that takes into consideration fine-grained password policies and can be run over Cobalt Strike's execute-assembly.
July 27, 2020 - 225 Shares
Axiom - Pen-Testing Server For Collecting Bug Bounties Axiom – Pen-Testing Server For Collecting Bug Bounties
Project Axiom is a set of utilities for managing a small dynamic infrastructure setup for bug bounty, basically a pen-testing server out of the box with 1-line.
July 7, 2020 - 342 Shares
Quasar RAT - Windows Remote Administration Tool Quasar RAT – Windows Remote Administration Tool
Quasar is a fast and light-weight Windows remote administration tool coded in C#. Used for user support through day-to-day administrative work to monitoring.
May 28, 2020 - 500 Shares
Pingcastle - Active Directory Security Assessment Tool Pingcastle – Active Directory Security Assessment Tool
PingCastle is a Active Directory Security Assessment Tool designed to quickly assess the Active Directory security level based on a risk and maturity framework.
May 19, 2020 - 312 Shares
Second Order - Subdomain Takeover Scanner Tool Second Order – Subdomain Takeover Scanner Tool
Second Order Subdomain Takeover Scanner Tool scans web apps for second-order subdomain takeover by crawling the application and collecting URLs (and other data)
April 30, 2020 - 332 Shares


5 Responses to FIS [File Inclusion Scanner] v0.1 – PHP Vulnerability

  1. dre October 8, 2006 at 12:14 am #

    you guys have a habit of posting web application attack tools which no longer exist. Both Oedipus and now FIS websites no longer exist!

  2. Darknet October 8, 2006 at 6:06 pm #

    Ah that sucks, it was up when I posted this I checked.

    I think I have a copy somewhere, I’ll upload it when I get chance.

  3. Zapotek October 9, 2006 at 1:26 pm #

    I had some probs with my hosting company…
    It’s up now, sorry.

    Oh yeah, Zapotek here….. hehehe

    SegFault.Gr will move again but it’ll be up again shortly. ;)

  4. Darknet October 15, 2006 at 3:21 pm #

    Thanks for the update Zapotek :)

  5. Zapotek November 26, 2007 at 1:14 am #

    Since I still get visitor looking for FIS from this article,
    I thought I’d let you know that the new link is:
    http://segfault.gr/projects/?lang=en&projects_id=11&secid=28

    Cheers.