Thursday, July 14, 2011

Hack a Website Using Remote File Inclusion

Remote file inclusion is basically a one of the most common vulnerability found in web application. This type of vulnerability allows the Hacker or attacker to add a remote file on the web server. If the attacker gets successful in performing the attack he/she will gain access to the web server and hence can execute any command on it.....

Searching the Vulnerability

Remote File inclusion vulnerability is usually occured in those sites which have a navigation similar to the below one

To find the vulnerability the hacker will most commonly use the following Google Dork


This will show all the pages which has “index.php?page=” in their URL, Now to test whether the website is vulnerable to Remote file Inclusion or not the hacker use the following command

Lets say that the target website is

So the hacker url will become

If after executing the command the homepage of the google shows up then then the website is vulnerable to this attack if it does not come up then you should look for a new target. In my case after executing the above command in the address bar Google homepage shows up indicating that the website is vulnerable to this attack

Now the hacker would upload the shells to gain access. The most common shells used are c99 shell or r57 shell. I would use c99 shell. You can download c99 shell from the link below:

The hacker would first upload the shells to a webhosting site such as ripway . com, 110mb . com etc.

Now here is how a hacker would execute the shells to gain access. Lets say that the url of the shell is

Now here is how a hacker would execute the following command to gain access

Remember to add “?” at the end of url or else the shell will not execute. Now the hacker is inside the website and he could do anything with it


Post a Comment

Share our post if you like it..

Related Posts Plugin for WordPress, Blogger...

IP info



study (19) education (18) coding (11) Codes (9) ciphers (9) cryptology (9) CRYPTOGRAPHY (8) Hacking Tutorials (5) Ethical hacker/hacking (4) Exploits and Incident Handling (4) HACKING WINDOWS (4) Make A Cipher (4) Windows (4) password breakers/crackers (4) Dictionary (3) Ebook (3) Facebook (3) Facebook Emoticons (3) Google Dork (3) Google Hacks (3) facebook symbols (3) php hack (3) tools (3) ASCII art (2) Facebook Animated Gif Image Status (2) GRE (2) GRE Dictionary (2) Hack a Website (2) IELTS (2) Java: A Beginner's Guide (2) Password Cracking (2) Password Recovery (2) SOCIAL ENGINEERING TOOLKIT (2) Session hijacking (2) find the vulnerability (2) java (2) password-auditing (2) password-cracker (2) php (2) Abel (1) Backtrack 5 (1) Barron’s GRE word list (1) Breaking Ciphers (1) CIPHERTEXT (1) CRYPTANALYSIS (1) Caesar's Shift Cipher (1) Cain (1) Cain and Abel (1) Crypters Binders RC4 (1) DOS (1) Facebook Chat Text Generator (1) Fast leech generator (1) Hacking Tools (1) HconSTF (1) List of best anonymizers (1) Make fake virus (1) Number Shift Cipher (1) One Pig's Pen (1) RFI (1) Remote file inclusion (1) SEO (1) SQL injection (1) Security 504 Hacker Techniques (1) Steal/trace ip (1) The Key (1) The Rail Fences (1) Toefl (1) Uses of proxy server (1) Virus (1) Vocabulary Word List (1) Winding Way Cipher (1) blog tips (1) brute force (1) brute forcing. (1) brutus (1) brutus-aet2 (1) (1) brutus-password-cracker (1) bypass web-filters (1) chat (1) command prompt (1) cookie stealing (1) crackers (1) e (1) fast download (1) hacking-software (1) hot file (1) improve site (1) ip catcher (1) ip tracker (1) leech (1) leecher (1) list of proxy servers (1) mail (1) mega upload (1) mobile (1) network-sniffing (1) rapid share (1) regular download link into premium (1) serial keys 94fbr (1) symbols (1) th3j35t3r's DOS tool (1)



☁ Partners Link Cloud ☁