Security research tool

INCLUDED

you've been INCLUDED.

A modular File Inclusion (LFI/RFI) scanner built around modern exploitation techniques that older tools like LFISuite, liffy, and kadimus never picked up — filter chains, two-phase log/session poisoning, and a full set of filter bypass variants.

View on GitHub Usage Modules

Authorized use only. This tool is built for HTB/CPTS labs, CTFs, your own environments, and engagements you are explicitly authorized to test. Running it against systems you do not own or do not have written permission to test is illegal in most jurisdictions.

Why

Modern technique coverage

A php://filter chain generator builds a PHP payload byte-by-byte from an empty stream, giving RCE with no file upload at all — a technique most existing LFI tools don't implement.

ffuf-style ergonomics

One INCLUDE marker in the URL, match/filter flags (-mc/-fc/-ms/-fs/-mr/-fr), and profiles (read/rce/all) for anyone used to ffuf or nmap.

Signal over noise

Results are deduplicated to the first confirmed hit per file, and traversal depth is auto-detected instead of brute-forced — measured 94% fewer requests for the same result.

Auto-hosted RFI

Point it at a target with --lhost/--lport and it stands up a minimal HTTP server on the spot to serve the web shell, no separate infrastructure required.

Installation

# clone, then let the script figure out pipx vs a local venv
git clone https://github.com/JJuly02/INCLUDED.git
cd INCLUDED
./install.sh
included --help

No git on the box (e.g. a locked-down pwnbox)? Grab the archive directly instead:

wget https://github.com/JJuly02/INCLUDED/archive/refs/heads/main.tar.gz
tar xzf main.tar.gz
cd INCLUDED-main
./install.sh

Usage

The INCLUDE marker in the URL marks the injection point, the same way FUZZ works in ffuf.

# basic scan with all modules
included -w "http://host/index.php?language=INCLUDE"

# target a specific file, verbose output
included -w "http://host/?p=INCLUDE" -f /etc/passwd -v

# RCE techniques only, with a command and session
# (a PHPSESSID cookie also enables session poisoning)
included -w "http://host/?p=INCLUDE" --profile rce --cmd "id" -b PHPSESSID=abc123

# fuzz, filter out noise, write results to JSON
included -w "http://host/img.php?p=INCLUDE" -fs 0 -mc 200 -o out.json -of json

# use an external wordlist, e.g. SecLists, instead of the bundled defaults
included -w "http://host/?view=INCLUDE" -W /usr/share/SecLists/Fuzzing/LFI/LFI-Jhaddix.txt -fs 1935

Output stays quiet by default — confirmed findings and a summary only. Each finding gets one isolated re-fetch after the main scan to confirm it reproduces and to capture full evidence.

Modules

Module	Group	What it does
`traversal`	read	`../` plus filter bypasses (`....//`, `..././`, prefixes, encoding); traversal depth is auto-detected
`filter_read`	read	`php://filter` — dumps source files as base64
`data`	rce	`data://` web shell (requires `allow_url_include`)
`input`	rce	`php://input` — web shell in the POST body
`expect`	rce	`expect://` — direct command execution
`zip_phar`	rce	`zip://` / `phar://` from an uploaded archive (`--file`)
`log_poison`	rce	Two-phase: poison access.log or a PHP session, then include it
`filter_chain_rce`	rce	`php://filter` chain — builds a PHP web shell in-flight with no file upload at all, adapted from Synacktiv's technique. Requires glibc `iconv` on the target (typical on Linux).
`rfi`	rce	Remote File Inclusion; with `--lhost`/`--lport` it auto-hosts the web shell over HTTP for the target to fetch. `ftp://` and UNC payloads are generated too, but need your own FTP/SMB server.

Profiles group modules for quick selection: --profile read|rce|all.