# 5. Remote File Inclusion (RFI)

**Key Takeaways:**

* **RFI vs. LFI:**
  * RFI allows including remote files, while LFI includes local files.
  * RFI often implies LFI, but not vice versa.
  * RFI enables SSRF and remote code execution.
* **Vulnerable Functions:**
  * Functions like `include()`, `file_get_contents()`, and others can be vulnerable.
  * The table provided is a good reference.
* **Verification of RFI:**
  * Checking `allow_url_include` in PHP is a start.
  * Testing with a local URL (e.g., `http://127.0.0.1`) is crucial.
  * Testing to see if the included file is executed, or just displayed is also very important.
* **Remote Code Execution:**
  * Creating a malicious script (e.g., a PHP web shell).
  * Hosting the script on a remote server.
  * Including the script through the RFI vulnerability.
* **Hosting Methods:**
  * **HTTP:**
    * Using Python's `http.server` module.
    * Common and straightforward.
  * **FTP:**
    * Using Python's `pyftpdlib`.
    * Useful for bypassing certain firewalls or WAFs.
    * Authentication within the URL is covered.
  * **SMB:**
    * Using Impacket's `smbserver.py`.
    * Specifically for Windows servers.
    * Utilizing UNC paths.
    * Important to note that this is more reliable on internal networks.

**Additional Considerations:**

* **Security Implications:**
  * RFI is a severe vulnerability that can lead to complete server compromise.
  * Disabling remote URL inclusion is a critical security measure.
* **WAF Bypasses:**
  * Attackers may use encoding, obfuscation, or different protocols to bypass WAFs.
  * It is very important to test many different protocols.
* **SSRF Exploitation:**
  * RFI can be combined with SSRF to access internal services and resources.
  * The referenced Server-Side Attacks module is important.
* **Real-World Scenarios:**
  * Attackers often combine RFI with other vulnerabilities for greater impact.
  * Attackers will often use reverse shells instead of simple web shells.
* **Defense in Depth:**
  * Proper input validation and sanitization are essential.
  * Network segmentation and firewalls can limit the impact of RFI.
  * Keeping software up to date is very important.
* **Protocol Diversity:**
  * The demonstration of HTTP, FTP, and SMB highlights the importance of understanding various protocols.
  * Attackers may use less common protocols to evade detection.
