⚠️ Overview

Flunky is a lightweight, automated web vulnerability scanner first documented in early 2022 by the security research team at Positive Technologies. It was designed for rapid reconnaissance of PHP and ASP.NET applications, primarily targeting misconfigured file upload endpoints and exposed administrative panels. The tool is maintained by an anonymous developer and distributed via a hidden GitHub repository (since removed) and underground forums, often bundled with other scanning utilities like dirb and sqlmap.

🔧 Technical Capabilities

Flunky employs a multi‑threaded scanning engine that sends a fixed set of HTTP GET and POST requests to enumerate directories, backup files, and default credentials. It specifically checks for LFI (Local File Inclusion) and RFI (Remote File Inclusion) by injecting path traversal payloads into URL parameters such as ?page= and ?file=. The scanner also performs basic SQL injection testing by appending single quotes and sleep‑based time‑delay vectors (e.g., 1 AND SLEEP(5)) to common parameter names like id, cat, and product. Additionally, it carries a small dictionary of over 500 common username/password combinations, attempting brute‑force logins on wp‑admin, Joomla! administrator panels, and Tomcat Manager interfaces. Flunky’s traffic pattern is distinctive: it sends a consistent User‑Agent string (see Detection Indicators) and always completes with a short three‑second timeout between requests, making it easily distinguishable from legitimate crawlers yet still capable of evading basic rate‑limiting rules when run with a proxy.

📜 History & Notable Incidents

Flunky was first identified in a widespread campaign against WordPress sites in March 2022, where it scanned over 50,000 domains in a single week, as reported by the Sucuri blog. In June 2022, a variant of Flunky was linked to the exploitation of CVE‑2021‑24406, a file upload vulnerability in the WordPress WP‑JobManager plugin. Researchers at Imperva later correlated Flunky’s IP ranges with a separate credential‑stuffing attack against e‑commerce sites in late 2022. While no direct CVE has been assigned to the tool itself, its use in multiple data breaches has led to its inclusion in threat intelligence feeds such as AlienVault OTX and MISP.

🔍 Detection Indicators

The primary detection fingerprint is the User‑Agent string: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Flunky/1.0 (note the deliberate misspelling of “Mozilla”). Behavioral indicators include a request rate of exactly 5 requests per second, a fixed Accept‑Language header of en‑US,en;q=0.5, and the absence of Accept‑Encoding support. Additionally, Flunky always sends a Referer header set to https://www.google.com/ regardless of the target domain, a signature used to evade simple referrer checks.

☠️ Risk & Impact

A successful scan by Flunky can reveal sensitive configuration files (e.g., config.php.bak), exposed admin panels, and backdoors left by previous infections. If a brute‑force attempt succeeds, an attacker gains full administrative control over the target application, potentially leading to data exfiltration, defacement, or installation of persistent webshells. The scanner itself does not carry out post‑exploitation actions, but it provides a reliable reconnaissance blueprint for subsequent human‑led attacks.

🛡️ Mitigation

Because Flunky is exclusively used for unauthorized reconnaissance and exploits, it is blocked immediately upon detection. No legitimate use case exists for this tool outside of controlled penetration testing environments with explicit written authorization. Web application firewalls (WAFs) and custom rule sets should log and drop any traffic matching its distinct User‑Agent and request pattern.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the bots listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.