• Home
  • /
  • Blog
  • /
  • How to Hack a Website using Remote File Inclusion (RFI)

How to Hack a Website using Remote File Inclusion (RFI)

by Mubi 

Remote File Inclusion (RFI) is a technique that allows the attacker to upload a malicious code or file on a website or server. The vulnerability exploits the different sort of validation checks in a website and can lead to code execution on server or code execution on website. This time, I will be writing a simple tutorial on Remote File Inclusion and by the end of tutorial, I suppose you will know what it is all about and may be able to deploy an attack.

RFI is a common vulnerability. All the website hacking is not exactly about SQL injection. Using RFI you can literally deface the websites, get access to the server and play almost anything with the server. Why it put red alert to the websites, just because of that you only need to have your common sense and basic knowledge of PHP to execute malicious code. BASH might come handy as most of servers today are hosted on Linux.


First of all we need to find out a RFI vulnerable website. Let’s see how we can find one.

As we know finding a vulnerability is the first step to hack a website or server. So, let’s get started and simply go to Google and search for the following query.

inurl: “index.php?page=home”

At the place of home, you can also try some other pages like products, gallery and etc.

If you already a know RFI vulnerable website, then you don’t need to find it through Google.

Once we have found it, let’s move to the next step. Let’s see we have a following RFI vulnerable website.


As you can see, this website pulls documents stored in text format from server and renders them as web pages. Now we can use PHP include function to pull them out. Let’s see how it works.


I have included my malicious code txt URL at the place of home. You can use any shell for maliciousScript like c99, r57 or any other.

Now, if it’s a really vulnerable website, then there would be 3 things that can happen.

  1. You might have noticed that the url consisted of “page=home” had no extension, but I have included an extension in my URL, hence the site may give an error like ‘failure to include maliciousScript.txt’, this might happen as the site may be automatically adding the .txt extension to the pages stored in server.
  2. In case, it automatically appends something in the lines of .php then we have to use a null byte ‘%00’ in order to avoid error.
  3. Successful execution.

As we get successful execution of the code, we’re good to go with the shell. Now we’ll browse the shell for index.php. And will replace the file with our deface page.

About the author 

Mubi Ace

May 16, 2024

Complete Guide To XSS Cross Site Scripting

May 16, 2024

How to Hack a Website using Remote File Inclusion (RFI)

December 15, 2023

What Is 4chan? A Detailed Guide To The Internet’s Anonymous Playground
Leave a Reply

Your email address will not be published. Required fields are marked

The reCAPTCHA verification period has expired. Please reload the page.

{"email":"Email address invalid","url":"Website address invalid","required":"Required field missing"}
Complete Guide To XSS Cross Site Scripting
How Online Slots Have Changed Video Gaming
How to stay safe in an online casino
How To Delete Albums On Your iPhone?
How to Turn Off PS5?: An Easy Guide
Share via
Copy link
Powered by Social Snap