Have an account?
It looks like you're new here. If you want to get involved, click one of these buttons!
Apply for Membership
Who's Online (1)
Looking to introduce yourself? Look no further, and click here! We also have IRC! [irc.evilzone.org #iexploit]
Web Application Security
Hack a website by using RFI
Hack a Website Using Remote File Inclusion
Remote file inclusion is basically a one of the most common vulnerability found in web application. This type of vulnerability allows the Hacker or attacker to add a remote file on the web server. If the attacker gets successful in performing the attack he/she will gain access to the web server and hence can execute any command on it.
Searching the Vulnerability
Remote File inclusion vulnerability is usually occured in those sites which have a navigation similar to the below one
To find the vulnerability the hacker will most commonly use the following Google Dork
This will show all the pages which has â€œindex.php?page=â€ in their URL, Now to test whether the website is vulnerable to Remote file Inclusion or not the hacker use the following command
Lets say that the target website is
So the hacker url will become
If after executing the command the homepage of the google shows up then then the website is vulnerable to this attack if it does not come up then you should look for a new target. In my case after executing the above command in the address bar Google homepage shows up indicating that the website is vulnerable to this attack
Now the hacker would upload the shells to gain access. The most common shells used are c99 shell or r57 shell. I would use c99 shell. You can download c99 shell from the link below:
The hacker would first upload the shells to a webhosting site such as ripway.com, 110mb.com etc.
Now here is how a hacker would execute the shells to gain access. Lets say that the url of the shell is
Now here is how a hacker would execute the following command to gain access
Remember to add â€œ?â€ at the end of url or else the shell will not execute. Now the hacker is inside the website and he could do anything with it
I have just copied and pasted this tutorial in my usb and forgot who is the Writer. :D
thankz bro is this working in website have a premium sell?
I'm sure i've seen this tut before, liked it back then and still do, it's a farily good tutorial for noobies getting into RFI :)
The only thing I like to see is an explanation on
this attack is possible, might be worth explaining the code that allows for RFI.
Thanks and keep going :)
I wouldn't say its the
but good tut
Good tut, but watch out the urls have been shorten and you cant see what you have put, so put them in the
when you want to copy tuts from other sites better press quote and copy what is in the quote because the urls are like that:
how can we download it? :P
Please explain more in debt in the site like the. .. parts
Add a Comment