Navigation



inspathx – Tool For Finding Path Disclosure Vulnerabilities

Last updated: April 20, 2012 | 8,351 views

The New Acunetix V12 Engine


inspathx is a tool that uses local source tree to make requests to the URL and searches for path inclusion (Full Path Disclosure) error messages. It’s a very common problem in PHP web applications that crops up a lot.

PHP Web application developers sometimes fail to add safety checks against authentications, file inclusion etc and are prone to reveal possible sensitive information when those applications URLs are directly requested. Sometimes, it’s a clue to Local File Inclusion (LFI) vulnerability. For open-source applications, source code can be downloaded and checked to find such information.

This script will do this job.

  1. First you have to download source archived file of your desired OSS.
  2. Second, extract it.
  3. Third, feed its path to inspath

inspathx accepts the following arguments:

  • -d or –dir argument as source directory (of application)
  • -u or –url arguement as the target base URL (like http://victim.com)
  • -t or –threads argument as the number of threads concurrently to run (default is 10)

You can download inspathx via SVN here:

Or read more here.

Share1
Tweet5
+1
Share
6 Shares
Posted in: Hacking Tools, Web Hacking

, , , ,


Latest Posts:


NetBScanner - NetBIOS Network Scanner NetBScanner – NetBIOS Network Scanner
NetBScanner is a NetBIOS network scanner tool that scans all computers in the IP addresses range you choose, using the NetBIOS protocol.
July 8, 2018 - 146 Shares
Metta - Information Security Adversarial Simulation Tool Metta – Information Security Adversarial Simulation Tool
Metta is an information security preparedness tool in Python to help with adversarial simulation and assess security defense preparation and alerts.
June 27, 2018 - 105 Shares
Powershell-RAT - Gmail Exfiltration RAT Powershell-RAT – Gmail Exfiltration RAT
Powershell-RAT is a Python-based Gmail exfiltration RAT that can be used a Windows backdoor to send screenshots or other data as an e-mail attachment.
June 24, 2018 - 245 Shares
SCADA Hacking - Industrial Systems Woefully Insecure SCADA Hacking – Industrial Systems Woefully Insecure
It seems like SCADA hacking is still a topic in hacker conferences, and it should be with SCADA systems still driving power stations, manufacturing plants etc.
June 20, 2018 - 129 Shares
airgeddon - Wireless Security Auditing Script airgeddon – Wireless Security Auditing Script
Airgeddon is a Bash powered multi-use Wireless Security Auditing Script for Linux systems with an extremely extensive feature list.
June 18, 2018 - 138 Shares
Acunetix v12 - Pause & Resume Acunetix v12 – More Comprehensive More Accurate & 2x Faster
Acunetix, the pioneer in automated web application security software, has announced the release of Acunetix v12 - more comprehensive, accurate & 2x faster.
May 23, 2018 - 126 Shares


One Response to inspathx – Tool For Finding Path Disclosure Vulnerabilities

  1. yehgbot October 12, 2010 at 3:55 pm #

    It’s been updated today with added syntax and language support. Update @ svn checkout http://inspathx.googlecode.com/svn/trunk/ inspathx-read-only