Waraxe Forums - Some questions on Remote file inclusion attacks?

manoj9372 · Regular user

Hi guys,
i have been started to learn/read about RFI attacks and i have readed some books,documents and some tutorials regarding this.

At the i have been ended up with some questions,i tought it would be good to ask here

here are my questions:

1)does RFI attacks only works with the php language?
2)dont this attack work on other server side scripting languages such as jsp,asp and other server side scripting languages?
3)if yes why?
4)is this the one and only form of RFI injection?

waraxe · Site admin

RFI is usually associated with PHP because it contains functions,
that can retrieve remote file and evaluate its content as php code.
I'm not aware of similar exploitability in other programming languages.

Now, why is RFI dying. Well, at least two reasons:

1. "allow_url_include" php confinguration setting, avaliable from
version 5.2.0 and "off" by default.

http://php.net/manual/en/filesystem.configuration.php

2. "register_globals" off-the-box default value changed:

http://php.net/manual/en/security.globals.php

"Perhaps the most controversial change in PHP is when the default
value for the PHP directive register_globals went from ON to OFF
in PHP > 4.2.0"

Right now, in year 2011 most real world php servers have indeed
"allow_url_include=0" and "register_globals=0", so variable tampering
as favourite RFI method does not work and even if you can get thru this,
then you get error message
"Warning: include() [function.include]: URL file-access is disabled in the server configuration".

And by the way - don't limit yourself with RFI only. Think out of the box.
There can be various ways to get remote server running your code. It all
depends on specific target. Good hacker or pentester knows as many as possible
ways to exploit things and RFI is just small subset of possibilities!