fimap

fimap -u "<url>?file=<vuln_param>"

Tool for exploiting LFI with file detection and escalation to RCE via log poisoning.

When you have a confirmed LFI and want to obtain a shell or read files. fimap performs a quick scan to find accessible files and then attempts RCE. It is useful for automating post-LFI exploitation.

If the application has strong filters that evade fimap's payloads, or if the LFI is highly restricted (only reading certain directories).