# Nayra | LFI Exploitation Tool

**URL:** <https://onehack.st/t/nayra-lfi-exploitation-tool/233938>\
**Category:** Tools & Scripts\
**Tags:** hacking, freebies\
**Created:** [March 10, 2023, 5:01pm UTC](https://onehack.st/t/nayra-lfi-exploitation-tool/233938 "2023-03-10T17:01:00Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Astrid](https://onehack.st/user_avatar/onehack.st/astrid/32/174869_2.png) [@Astrid](https://onehack.st/u/Astrid)\
**Post date:** [March 10, 2023, 5:01pm UTC](https://onehack.st/t/nayra-lfi-exploitation-tool/233938/1 "2023-03-10T17:01:00Z")

</div>

[![](https://cloud.githubusercontent.com/assets/12601189/8551306/a78ded2c-24cd-11e5-8493-a71824533352.gif) ](https://cloud.githubusercontent.com/assets/12601189/8551306/a78ded2c-24cd-11e5-8493-a71824533352.gif)

## Nayra - LFI Exploitation Tool

* * *

[![python](https://camo.githubusercontent.com/3d8250023b3998f3a4f98489daf01b9b3c87132f5100a1b6aa3896d348da2dfc/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f707974686f6e2d322e372d677265656e2e7376673f7374796c653d666c6174)](https://camo.githubusercontent.com/3d8250023b3998f3a4f98489daf01b9b3c87132f5100a1b6aa3896d348da2dfc/68747470733a2f2f696d672e736869656c64732e696f2f62616467652f707974686f6e2d322e372d677265656e2e7376673f7374796c653d666c6174)

This is a small tool to exploit a LFI (Local File Inclusion) web vulnerability. The tool provide a functional shell prompt. In the future, I will add some very useful extra options.

### Disclaimer

- **Legal** : This tool is designed only for **educational** purposes and **ethical** hacking. Use it at your own responsibility. Damages or legal problems caused by the tool are the responsibility of the user.
- **License** : This tool is subject under the following license:

> Creative Commons Attribution-ShareAlike 3.0

[![](https://camo.githubusercontent.com/15caa29e1c1eee97bbc907cf2c3bc05d89bdd029af302d0baceea292a68aa56c/68747470733a2f2f6c6963656e7365627574746f6e732e6e65742f6c2f62792d73612f332e302f38387833312e706e67 "Creative Commons")](https://camo.githubusercontent.com/15caa29e1c1eee97bbc907cf2c3bc05d89bdd029af302d0baceea292a68aa56c/68747470733a2f2f6c6963656e7365627574746f6e732e6e65742f6c2f62792d73612f332e302f38387833312e706e67)

More Info: [Here](https://creativecommons.org/licenses/by-sa/3.0/)

### Usage

- **Required Parameters** :

```auto
-t, --type Specifies the type of action
-u, --url URL vulnerable to LFI (Local File Inclusion)

```

- **List of types** :

```auto
shell Exploit the vulnerability to get a shell
upload Upload a file to remote server
msfvenom Upload payload generated by msfvenom

```

- **Optional Parameters** :

```auto
-m, --method (=GET) It can be -> [GET|POST]
-n, --name (=php_1) Used to specify the corresponding attack
                         payload in "data.json"

-f, --file File to upload (Only "upload" or "msfvenom" types)
-a, --argvs Secondary parameters (Only "msfvenom" type)

-c, --cookies Session cookies
-x, --proxy Using a proxy -> [http://user:passwd@host:port]
-p, --path When it is necessary to make a directory traversal
-b, --null-byte Add Poison Null Byte (%00)

```

- **Other Parameters** :

```auto
-h, --help Display this message

```

### Demo

[![nayra](https://cloud.githubusercontent.com/assets/12601189/8551306/a78ded2c-24cd-11e5-8493-a71824533352.gif)](https://cloud.githubusercontent.com/assets/12601189/8551306/a78ded2c-24cd-11e5-8493-a71824533352.gif)

### About

This tool was created by: **@codexlynx**.

- Twitter: [https://twitter.com/codexlynx](https://twitter.com/codexlynx)
- GitHub: [https://github.com/codexlynx](https://github.com/codexlynx)

* * *

About the tool name:

**In Spanish:** [https://es.wikipedia.org/wiki/Nayra](https://es.wikipedia.org/wiki/Nayra)

## GitHub:

[https://github.com/codexlynx/nayra](https://github.com/codexlynx/nayra)