Fuxploider

Fuxploider is an open-source penetration testing tool designed to automate the detection and exploitation of file upload form vulnerabilities. It can identify allowed file types and determine the most effective technique for uploading web shells or malicious files to a targeted web server.

Disclaimer

This tool is intended for educational and ethical testing purposes only. Unauthorized use of Fuxploider to scan or exploit vulnerabilities without explicit permission is illegal and unethical. The creators of this tool are not responsible for any misuse or damage caused by this tool.

Description

Fuxploider simplifies the process of testing file upload forms for security flaws by automating the detection and exploitation steps. This tool is particularly useful for penetration testers and security researchers who need to identify weak points in web applications that allow file uploads. By determining the types of files that can be uploaded and the techniques that can bypass security measures, Fuxploider aids in uncovering vulnerabilities that could be exploited by malicious actors.

Features

• Automated detection: Identifies file types allowed by upload forms.
• Exploitation: Determines the best technique to upload malicious files or web shells.
• Efficiency: Streamlines the process of testing and exploiting file upload vulnerabilities.

Installation

To install Fuxploider, you need Python 3.6 or higher. Follow these steps:

git clone https://github.com/almandin/fuxploider.git
cd fuxploider
pip3 install -r requirements.txt
        

If you encounter issues with pip (especially on Windows), use the following command:

python3 -m pip install -r requirements.txt
        

Docker Installation

You can also install and run Fuxploider using Docker:

# Build the docker image
docker build -t almandin/fuxploider .
        

Usage

To view a list of basic options and switches, use the help command:

python3 fuxploider.py -h
        

Here is a basic example of how to use Fuxploider:

python3 fuxploider.py --url https://awesomeFileUploadService.com --not-regex "wrong file type"
        

Detailed Explanation

Fuxploider works by analyzing file upload forms to determine the types of files that can be uploaded. It then tests various techniques to see which ones can bypass any security measures in place, allowing malicious files or web shells to be uploaded. This automated approach saves time and effort for security professionals by providing quick and accurate results.

Once installed, Fuxploider can be used to test different file upload forms by specifying the URL of the service. The tool offers various options to customize the tests, such as specifying patterns to identify rejection messages (e.g., "wrong file type"). This flexibility makes Fuxploider a powerful tool for uncovering vulnerabilities in web applications.

It is important to use Fuxploider responsibly and within the legal boundaries. Always obtain proper authorization before testing any web application or service.