How To Hack Websites Using RFI Attack

 05/25/2017 - 06:31
Analyse Using RFI Attack

Find a Vunerable websites using Google Dork― inurl index php?page=‖ its Most Popular Dork of RFI hacking
This will show all the pages which has ―index php?page=‖ in their URL,
Now to test whether the website is vulnerable to Remote file Inclusion or not the hacker use the following

Example command: target site link

See example of this website: cbsk link

So the hacker url will become Cbsk test
If after executing the command the homepage of the google shows up then then the website is vulnerable to this attack if it does not come up
then you should look for a new target.

In my case after executing the above command in the address bar Google homepage shows up indicating that the website is vulnerable to this attack. Now the hacker would upload the shells to gain access. The most common shells used are c99 shell or r57 shell. I would use c99 shell. You can download c99 shell from the link: Download Link: Click here

rfi web attack

The hacker would first upload the shells to a webhosting site such as ripway.com, viralhosts.com,110mb.com or another free hosts etc.
Now here is how a hacker would execute the shells to gain access. Lets say that the url of the shell is RFI example
Now here is how a hacker would execute the following command to gain access

Final test link

Don't Forget To add ―?‖ after .txt at the end of url or else the shell will not execute. Now the hacker is inside the website and he could do anything with it he can upload deface pages... etc to pwned the site.



Term and Condition: Read Only for Educational Purpose

admin's picture
Arshad Ali Ansari

Follow the author on         or visit   Personal Blog