RFI
Remote File Inclusion (RFI) is attackers making the server include a file from a remote URL, executing remote code on the server.
Purpose
To understand the RCE caused by remote file inclusion and its defenses; a critical vulnerability when PHP allow_url_include is enabled.
Mechanism
The program uses include($_GET[page]) with allow_url_include=On; the attacker supplies http://evil.com/shell.txt so the server downloads and executes remote PHP. Defenses: disable allow_url_include, path whitelists.
Use cases
- PHP RFI vulnerabilities
- Remote inclusion defense
- Server security