Remote File Inclusion (RFI) — Full Breakdown for Beginners
1 min read
Summary
RFI stands for Remote File Inclusion and refers to the practice of including files from remote servers onto vulnerable web sites.
This is typically done through the include or require PHP functions without proper validation or sanitisation of the input data, which can allow an attacker to load files from a remote location onto the server.
This can be used to gain remote code execution and compromise a target, allowing the attacker to perform a variety of malicious actions, includingModification of website content, steal database credentials, perform a SQL injection, pivot into internal networks, or launch other attacks leveraging a now-trusted domain reputation.
To prevent RFIs, best practices involve sanitising all user input, setting strict file extension requirements, using a fixed directory path, and setting the allow_url_include and allow_url_fopen parameters to Off in the php.ini file, and avoiding the use of dynamic loading where possible.