Wordpress A.F.D. Verification

Check arbitrary file download vulnerability in the WordPress

 + Autor: MrCl0wn
 + Blog: http://blog.mrcl0wn.com
 + GitHub: https://github.com/MrCl0wnLab
 + Twitter: https://twitter.com/MrCl0wnLab
 + Email: mrcl0wnlab\@\gmail.com

WARNING

+------------------------------------------------------------------------------+
|  [!] Legal disclaimer: Usage of afdWordpress for attacking                   |
|  targets without prior mutual consent is illegal.                            |
|  It is the end user's responsibility to obey all applicable                  | 
|  local, state and federal laws.                                              |
|  Developers assume no liability and are not responsible for any misuse or    |
|  damage caused by this program                                               |
+------------------------------------------------------------------------------+

DESCRIPTION

This tool aims to facilitate checking arbitrary file download vulnerability

REQUIREMENTS

threading
argparse
csv
collections
random
urllib

INSTALL

$ git clone https://github.com/MrCl0wnLab/afdWordpress
$ cd afdWordpress
$ pip3.7 install -r requirements.txt

HELP

$ git clone https://github.com/MrCl0wnLab/afdWordpress
$ cd afdWordpress
$ python3.7 afd.py --help


        ▄████████    ▄████████ ████████▄  
        ███    ███   ███    ███ ███   ▀███ 
        ███    ███   ███    █▀  ███    ███ 
        ███    ███  ▄███▄▄▄     ███    ███ 
      ▀███████████ ▀▀███▀▀▀     ███    ███ 
        ███    ███   ███        ███    ███ 
        ███    ███   ███        ███   ▄███ 
        ███    █▀    ███        ████████▀ 
        Arbitrary File Download-[ Verifier ]
        By MrCl0wn
        
usage: tool [-h] --url http://url [--file /file.php] [--threads 10]

optional arguments:
  -h, --help        show this help message and exit
  --url http://url  URL to request Ex: http://www.host.com
  --file /file.php  File to fuzzing Ex: /wp-admin.php
  --threads 10      Threads

USE

$ python3.7 afd.py --url https://blog.mrcl0wn.com 
$ python3.7 afd.py --url https://blog.mrcl0wn.com --thread 50
$ python3.7 afd.py --url https://blog.mrcl0wn.com --thread 50 --file /etc/passwd

SOURCE VERIFICATION

File: inject.csv

DESCRIPTION FILE

exploit_uri: Request get for exploration and concatenation with target_url.

pwd_count: Count pwd for concatenation loop.

ref: This column is referential document.

OUTPUT RESULT

ok-file.log

error-file.log