Uniscan

Uniscan is designed to identify common web application vulnerabilities such as LFI, RFI, and RCE. It scans specified URLs for accessible directories, files, and dynamic elements that may indicate exploitable conditions. The tool also includes plugins for detecting specific issues like FCKeditor upload tests, web backdoors, phpinfo disclosure, and more.

Use cases include reconnaissance of web servers for vulnerability assessment, particularly during penetration testing of Apache or similar environments. It supports both command-line and GUI modes via uniscan-gui, making it suitable for quick scans or background operations.

The scanner crawls targets to find URLs and applies checks for robots.txt, sitemap.xml, and various plugins, providing output on discovered paths and potential vulnerabilities.

Uniscan operates by sending HTTP requests to the target URL for directory, file, and dynamic checks. It uses plugins like FCKeditor upload test, Web Backdoor Disclosure, phpinfo() Disclosure, Timthumb vulnerability, and others to probe for vulnerabilities. The crawler discovers additional URLs (e.g., 27 URLs found in the example), checks server responses (e.g., CODE 200), and reports findings such as accessible directories like /joomla/ and /wordpress/. It supports background mode and multiple input formats including URLs, files, IPs, and search queries.