Navigation



FIS [File Inclusion Scanner] v0.1 – PHP Vulnerability

Last updated: June 18, 2010 | 17,661 views

A useful tool for anyone working with PHP applications.

DESCRIPTION
————
FIS (File Inclusion Scanner) is a vulnerability scanner for PHP applications. Is scans PHP files mapping PHP/HTTP variables and then performs a security audit,in order to find out which of them are exploitable.

USAGE
——
php fis.php [local file] [remote file] [remote FIS ID file]

[local file]
————–
The local copy of the PHP source file used by FIS to map the variables for the audit.

[remote file]
————–
The remote copy of the source executed by a remote webserver, the file we will audit.

[remote FIS ID file]
———————-
The FIS ID file is used to check whether a variable is exploitable or not. It contains PHP code that simply echoes a unique MD5 hash used for identification.

INTENDED AUDIENCE
——————
FIS is intended to be used by penetration testers, not script kidies nor malicious users. It creates a lot of noise on the remote host and can be easily discovered with a simple glance at
the webserver logs, which makes it useless as a cracking tool.

FEATURES
———
FIS, currently, supports audits using only GET requests. COOKIE & POST support is not yet implemented.

LOGGING
———
FIS automatically logs extra audit information in “fis.log” in the working directory.

FIS Website

You can download FIS directly here.

Share
Tweet
Share
Buffer
WhatsApp
Email
0 Shares
Posted in: Countermeasures, Security Software, Web Hacking

,


Latest Posts:


Grype - Vulnerability Scanner For Container Images & Filesystems Grype – Vulnerability Scanner For Container Images & Filesystems
Grype is a vulnerability scanner for container images and filesystems with an easy to install binary that supports the packages for most major *nix based OS.
April 19, 2021 - 165 Shares
APT-Hunter - Threat Hunting Tool via Windows Event Log APT-Hunter – Threat Hunting Tool via Windows Event Log
APT-Hunter is a threat hunting tool for windows event logs made from the perspective of the purple team mindset to provide detection for APT movements hidden in the sea of windows event logs.
March 5, 2021 - 192 Shares
GitLab Watchman - Audit Gitlab For Sensitive Data & Credentials GitLab Watchman – Audit Gitlab For Sensitive Data & Credentials
GitLab Watchman is an app that uses the GitLab API to audit GitLab for sensitive data and credentials exposed internally, this includes code, commits, wikis etc
February 3, 2021 - 123 Shares
GKE Auditor - Detect Google Kubernetes Engine Misconfigurations GKE Auditor – Detect Google Kubernetes Engine Misconfigurations
GKE Auditor is a Java-based tool to detect Google Kubernetes Engine misconfigurations, it aims to help security & dev teams streamline the configuration process
January 1, 2021 - 161 Shares
zANTI - Android Wireless Hacking Tool Free Download zANTI – Android Wireless Hacking Tool Free Download
zANTI is an Android Wireless Hacking Tool that functions as a mobile penetration testing toolkit that lets you assess the risk level of a network using mobile.
December 7, 2020 - 228 Shares
HELK - Open Source Threat Hunting Platform HELK – Open Source Threat Hunting Platform
The Hunting ELK or simply the HELK is an Open-Source Threat Hunting Platform with advanced analytics capabilities such as SQL declarative language, graphing etc
November 6, 2020 - 210 Shares


5 Responses to FIS [File Inclusion Scanner] v0.1 – PHP Vulnerability

  1. dre October 8, 2006 at 12:14 am #

    you guys have a habit of posting web application attack tools which no longer exist. Both Oedipus and now FIS websites no longer exist!

  2. Darknet October 8, 2006 at 6:06 pm #

    Ah that sucks, it was up when I posted this I checked.

    I think I have a copy somewhere, I’ll upload it when I get chance.

  3. Zapotek October 9, 2006 at 1:26 pm #

    I had some probs with my hosting company…
    It’s up now, sorry.

    Oh yeah, Zapotek here….. hehehe

    SegFault.Gr will move again but it’ll be up again shortly. ;)

  4. Darknet October 15, 2006 at 3:21 pm #

    Thanks for the update Zapotek :)

  5. Zapotek November 26, 2007 at 1:14 am #

    Since I still get visitor looking for FIS from this article,
    I thought I’d let you know that the new link is:
    http://segfault.gr/projects/?lang=en&projects_id=11&secid=28

    Cheers.