Remote File Inclusion (RFI)

[@Veritas_Triumphus]

My apologies if its forbiden to "revive" thread but I had to add that I have never seen so good explained tutorial in my life. So much thanks Ande.

[Traitor4000]

Yeah nice tutorial certainly gonna save this one in my archive.
ps. Wolf your profile picture gives me a seizure 

[like2code]

Since this thread is bumped anyway.
Some little tricks i learned (some time ago, i.e. they might not work anymore)

/proc/self/environ
If you only have an LFI posibility but no RFI, and are one a OS supporting the proc filesystem:
Try including /proc/self/environ. It contains (if not disabled) at least with appache, variables like User-Agent, Referer,  and so on for the current request.
Both variables are under our control, so setting the user agent to

Code: (php) [Select]

<?php 'MINI_SHELL_OR_DROPPER_CODE' ?>could be interesting.
AFAIR: setting the login shell from the appache user to /sbin/nologin leads to no used environment variables.

Wrappers + filters
If you just want to read the source code of a php page using a LFI PHPs filter might be interesting.
They can be applied to to the file name like:

Code: [Select]

php://filter/convert.base64-encode/resource=FileNameToReadi.e. if we want to read the source code of 'password.php' via an LFI in index.php the request string might be looking like this:

Code: [Select]

http://somedomain.com/index.php?page=php://filter/convert.base64-encode/resource=passwordThis would return the content as base64 encoded text.
There are other filters like rot13 also.

Edit: I just realized that ande also wrote something about LFI containing this information (with way better explanation).

[dotszilla]

great tutorial bro.. dont get more easier to understand than that lol...

P.S you got some typos in there, i would recommend you do a spell check and fix the where/were mistakes.. i say that because for people reading it that english is not their forte, it could sound confusing.. besides that awesome tutorial..


EDIT: i just saw how old this was XD .... lol

[heeraj123]

We can even read the source code by using php filter by decoding the base64 filter.

http://www.example.com?page=php://filter/convert.base64-encode/resource=index

By decoding the base64 you would get the source.