kadimus (LFI)

kadimus -u "<url>?file=FUZZ"

Tool to exploit Local File Inclusion (LFI) with multiple bypass techniques and escalation to RCE.

When you find a parameter that seems to include local files (e.g., file, page, template). Kadimus automates LFI detection, tests different patterns (directory traversal, null byte, etc.) and also offers modules to achieve RCE via log poisoning or PHP wrappers.

If the target has a WAF that blocks LFI payloads, or if the file inclusion is remote (RFI) and not local. Prefer manual tools if the parameter is heavily obfuscated.