Using the FIMAP tool for file inclusion attacks (RFI/LFI)
In the very first recipe, the Burp Scanner also identified the file path travel vulnerability. In this recipe, we will learn how to use Fimap to exploit the file path traversal vulnerability.
Fimap is a Python tool that can help in finding, preparing, auditing and finally exploiting local and remote file inclusion bugs in web applications automatically.
To step through this recipe, you will need the following:
- Kali Linux running on Oracle Virtualbox/VMware
- Docker running on Kali Linux
- Vulnerable Web Application Docker container
- An Internet connection
How to do it...
For this recipe, you need to perform the following steps:
- Open the browser and navigate to