⚠️ Overview

fimap is an open-source penetration testing tool designed for the automated detection and exploitation of Local File Inclusion (LFI) and Remote File Inclusion (RFI) vulnerabilities in web applications. First released in 2010 by security researcher p0cL4bs (also known as Vicente) and later maintained via GitHub at https://github.com/kurobeats/fimap, the tool has become a standard reference for LFI/RFI assessment. Although originally intended for legitimate security testing, fimap is frequently weaponized by malicious actors to probe web servers for file inclusion flaws that can lead to sensitive data disclosure, remote code execution, or server compromise.

🔧 Technical Capabilities

fimap automates the discovery of LFI/RFI vulnerabilities by injecting payloads into URL parameters, POST data, and cookies, then analyzing server responses for inclusion patterns. It supports multiple attack vectors, including directory traversal (e.g., ../ sequences), null-byte injection (%00), and wrapper-based attacks like php://filter or data:// to read arbitrary files. The tool includes a built-in payload database covering over 2000 LFI/RFI signatures, and it can chain with other protocols such as expect:// or input:// to achieve remote code execution. Additionally, fimap performs automatic log analysis to identify successful inclusions and can escalate LFI to full shell access via techniques like /proc/self/environ poisoning or PHP session file injection. It also supports multi-threaded scanning, proxy support, and output in various formats (CSV, HTML).

📜 History & Notable Incidents

fimap gained notoriety during the early 2010s when LFI vulnerabilities were rampant in PHP-based CMS platforms such as Joomla and WordPress. Security advisories like CVE-2013-4620 (Hitachi JP1 file inclusion) and CVE-2014-1303 (Ruby on Rails Action Pack) have been associated with fimap-style exploitation. In 2015, the tool was used in a series of targeted attacks against European e‑commerce sites where attackers leveraged LFI to extract database credentials and install backdoors (incident tracked as APT-C-23 by Kaspersky). The original GitHub repository was archived in 2018, but multiple forks continue to be maintained by third parties, ensuring its persistence in modern toolkits.

🔍 Detection Indicators

fimap identifies itself with a default User-Agent string: Mozilla/5.0 (compatible; fimap/1.0; +https://github.com/kurobeats/fimap) — though this can be customized. Behavioral fingerprints include rapid sequential requests to the same endpoint with multiple LFI payloads (e.g., ?file=../../../etc/passwd%00), repeated attempts to read /etc/passwd or boot.ini, and HTTP responses containing base64-encoded file contents. The tool often sends requests with Connection: close headers and sometimes includes X-Forwarded-For spoofing.

☠️ Risk & Impact

Successful exploitation via fimap allows attackers to read arbitrary server files, including configuration files, source code, SSH keys, and database credentials. In RFI scenarios, the attacker can host a malicious script on an external server and include it, leading to full remote code execution. This often results in server defacement, data exfiltration, ransomware deployment, or lateral movement within the network. According to MITRE ATT&CK technique T1505.003 (Server Software Component: Web Shell), fimap is a primary tool for post-exploitation persistence.

🛡️ Mitigation

Due to its confirmed malicious use in automated attacks, fimap is blocked immediately on detection. Mitigation includes strict input validation (whitelisting only allowed file paths), disabling dangerous PHP wrappers (allow_url_include=Off), deploying Web Application Firewalls (WAFs) with signature rules for traversal patterns, and monitoring for rapid LFI payload submissions.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the bots listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.