NexusLFI is a high-performance Python security utility designed for automated Path Traversal and Local File Inclusion (LFI) vulnerability discovery. Built with a multi-threaded execution engine and intelligent response matching, NexusLFI efficiently crawls web applications, discovers sub-paths, and tests parameters against sensitive system file signatures to streamline web penetration testing and bug bounty workflows.
- Automated Link Crawling: Automatically extracts and scopes sub-paths from the target index page within the same domain.
- Multi-threaded Scanning: Utilizes Python's
ThreadPoolExecutorfor concurrent execution and high-speed fuzzing (up to 100 workers). - Smart Response Matching: Evaluates response bodies against predefined signatures (e.g.,
root:x:,[extensions]) to eliminate false positives. - Dual-Mode Testing: Tests direct payload injection (
/payload) and common file inclusion parameter patterns (/index.php?file=payload). - Extensive Payloads Repository: Includes a dedicated
payloadsdirectory packed with over 17,000 paths and payloads for deep fuzzing, with full support for adding custom payloads. - Interactive Terminal UI: Features a clean ASCII banner, real-time status counters, and color-coded HTTP status tracking.
- Python 3.x
requestslibrary
NexusLFI is intended strictly for authorized security research, ethical hacking, and bug bounty programs. The author assumes no liability and is not responsible for any misuse, unauthorized scanning, or damage caused by this software. Users must ensure they have explicit permission from the system owners before conducting any security testing.