Tuesday, February 15, 2011

How to hack websites by Remote File Inclusion

Hello friends, in my previous articles about website hacking, i have discussed different ways to hack websites and also i have explained the Website hacking using SQL injection in detail. Today i am going to explain and advanced method of hacking websites that is How to hack websites using Remote File Inclusion. As the name suggests Remote File Inclusion is technique where we inserts the file (in hacking terminology called Shell) in to the Website and gets the admin rights. Lets discuss this type of Website hacking technique in detail, so friends read on...

How to hack websites using Remote file inclusion
Remote File Inclusion : Website hacking Method

What is Remote File Inclusion?
Remote File Inclusion is a method of hacking websites and getting the admin rights of the server by inserting a remote file usually called as SHELL (a shell is graphical user interface file which is used to browsing the remote files and running your own code on the web servers) into a website, whose inclusion allows the hackers to execute the server side commands as a current user logged on, and have the access to all the server files. With these rights we can continue to use local exploits to escalate our privileges and get control over the whole server.
Note: Remote File Inclusion (RFI) is the best ever technique to hack websites and more than 60% websites on the internet using PHP are vulnerable to this attack.

Which Websites are Vulnerable to Remote File Inclusion attack?
First and the very basic question arises in the mind of new hackers that How we can find the websites that its prone to remote file inclusion attack. And what are the basic vulnerabilities in the website that we will target to hack any website and web server. Answer to these questions is quite simple. 
Many of the web servers are vulnerable to this type of attack because of PHP's default settings of register_globals  and allow_url_fopen being enabled. 
Note: In the PHP 6.0, register_globals has been removed but still the second vulnerability remains open, so we can give it a try to latest version PHP websites too. But a good news for hackers is that around 90% websites on the internet still uses old versions of PHP and another good news in those 90% websites, more than 60% websites has default settings enabled. That means we can hack most of the websites and deface them. Isn't that cool, but as i have said we are ethical hackers we only find vulnerabilities in the websites .

Now lets start step by step Remote file inclusion method to hack websites:
Step 1: Finding the Vulnerable Websites
First of all we have to find the website that gets his pages using the PHP include() function and vulnerable to RFI (Remote File Inclusion). The best technique is to find websites using Google Dorks. Google dorks are simply the queries that are used to identify the specific search results.
Download the list of Dorks for RFI : CLICK HERE
I have already listed a lot off GOOGLE DORKS in my previous post of hacking websites, so you can look them here:

Step 2: Identifying Vulnerable website

Websites that have the page navigation system similar to below mentioned:

Step 3: Checking Website is Vulnerable or Not
To check if a the website is vulnerable to remote file inclusion attack, we would try to include a website link  instead of PageName as shown below:

Now if the Google Home Page opens, then its confirmed that website is vulnerable to Remote File Inclusion attack and we will continue our attack. If Google homepage doesn't opens, we will try another website.

Step 4:  Remote Inclusion of Shells
Now we know that website is hackable, so we will now include the shells into the website. There are number of shells available online but my favorite are C99 and r57 because of their extended functionality and features.
There is no need to download these shells on your systems or PC, we can directly use the online resources for doing that but if you wish you can download them from their respective websites. I will not provide these here because its unethical but Google it and u can find them easily. 
To find the a shell the hacker would search Google for: 
This will display many websites with the shell already up and ready to be included.
Note: you must include a ? after the URL of Shell  so that if anything comes after c99.txt, it will be passed to the shell and not cause any problems.

For future use of Analysis you can download these shells from here:

The new URL with the shell included would look like:

Step 5: Adding Null Byte
Sometimes the PHP script on the server appends “.php” to the end of every included file. So if you included the shell, it would end up looking like “c99.txt.php” and not work. To get around this, you would add a null byte () to the end of c99.txt. This tells the server to ignore everything after c99.txt.

Step 6:  Vulnerabilities Database
In step one, I told you that hackers use Google dorks to look for sites possibly vulnerable to RFIs. An example of a Google dork would be:
This looks for URL’s with .php?page= in them. This is only an example and you most likely won’t find any vulnerable sites with that search. You can try switching around the word “page” with other letters and similar

Hackers usually search vulnerability databases like www.milw0rm.com for already discovered RFI vulnerabilities in site content management systems and search for websites that are running that vulnerable web application with a Google dork.

Step 6: If Attack Successful
If we succeeds in getting the server to parse the shell, then we will be see a screen similar to the following: 

hacking websites using remote file inclusion, learn how to hack websites
Hacking Website using Shell RFI attack

The shell will display information about the remote server and list all the files and directories on it. From here we would find a directory that has read and write privileges and upload the shell but this time as a .php file so that incase the vulnerability is fixed, he will be able to access it later on.  

Step7: Find Root Privileges on Server
Now we would next find a way to gain root privileges on the system. We can do this by uploading and running local exploits against the server. you can find list of such exploits on milw0rm. We could also search the victim server for configuration files. These files most of the times contain username and passwords for the MYSQL databases and such.

That's all the way to hack websites using the remote file inclusion method. I hope you all have liked it. And i am sure you all have a lot of questions regrading this, so don't hesitate and ask in form of comments. I will try to clear all your queries.

How to Protect your Websites and Forums from Remote file inclusion attack?
As we are ethical hackers i will also explain for webmasters to protect their websites from RFI attack.
To protect yourself from RFI attacks, simply make sure you are using up-to-date scripts, and make sure you server php.ini file has register_globals and allow_url_fopen disabled.

Note: Website hacking is illegal, this article is for Educational purposes only.

Thanks for reading.. Enjoy and have Happy Hacking..:)


  1. I saw the same post on hackfourms

  2. You might have seen it there... because its source is same that i.e. CEH course material. I haven't developed or find it i have also read this in CEH Level 2 course(Web application hacking and penetration testing), when i was doing certification... So i have shared with you guys in my terminology... Just few things are new in that:
    1. Addition of ? attribute
    2. Addition of Null byte
    3. A long list of vulnerable website dorks
    4. Stepwise description i.e what to do when.
    5. Little bit user friendly.. thats all...

    Hope you will understand... and probably this make it unique and probably the best post for RFI technique..

    Enjoy...Have Happy Hacking...

  3. Friends, the main motive of this post is that you should know how website hacking works. If you understands it then this post deserves comments and if not then also it deserves comments because its 100% working hack for hacking websites. I have hacked more than 1000's of websites and forums using this hack... and the proof you might have already seen while visting websites or hacker lounges on other forums with a name B-ullet or DeStrUTiVe M!nD or RofL h@cKeR or T3Am CobRA or simply I.C.A ( you understand the full form of ICA its our cyber army).
    Guys i am going to start recruitment to my new hacking Team from today onwards. So just wait for my latest post...

  4. hey lokesh....no reply from ur side ,as i hv post my email address for phishser of gmail and facebook....my email address is almaskaramat@gmail.com....please check the my previous comments also...regards

  5. i wana b the part of ur team....accept me..atleaset first come first basis

  6. great job it did work for me thanks dude lokesh singh

  7. @Almas
    i am agree with you... we want to be part of your team.


  8. @Lokesh@Admin
    Could you make pictures?

  9. @Anonymous
    yea sure... I will make a video and share with you all very soon... Thanks for your valuable comments..:)

  10. That's Pretty Awesome ... !! i was cracked down 2 web sites .. but i didn't do anything because we're ethical hackers ... ! :)

  11. wow such a knowlegeable article,lokesh just keep posting like these.
    I am a beginner and in need of doing a course in hyderabad as early as possible,can u suggest me the best course and the best training institute in hyderabad.also reply me if possible at my email,chipusingh@yahoo.com

  12. Rfi is easy :d :p
    but no much sites can be found vuln to rfi
    i checked all site for vb6 videos and found only c, c++ and java
    if u have some vb6 videos post it and not in hotfile coz needs a year to download
    or post vps hack
    tnx :D

  13. You should reverse engineer this method to have your website secured from hacking.

  14. i have checked over 30 websites .. :( bt i didn't got any of vulnerability site yet .. can anyone please just show me a example . !

  15. milworm is not working.........

  16. yea,milworm is not working.
    Tnx man.


  17. pls help mil worm is not working and novulnerabil site found yet.

  18. I urgently need a hacker that can hack sites? kindly get back to me if you willing to make $$$ with me via email universal_steel_xiiiiix@yahoo.com

  19. can u give an example of any site vulnerable to this attack...i cudn't find any..

  20. Hi Lokesh....
    can u pls write a tutorial on "what is ftp?How to use that to share files on loacal network or anything like that?""and also everything related to ftp???"

  21. Trojan virus in admin finder

  22. Thanks for sharing superb gclub informations. Your site is so cool.

  23. Thanks for the sbo information, I really enjoyed the post.

  24. thanks lokesh..
    and i want to know how to hack a website which doesnt have id=..

  25. hey frndz please help me please hack www.chatarea.in please frndz i request you


Please do not spam.

Designed by Hackingloops.