Testing for Remote File Inclusion
This article is part of the new OWASP Testing Guide v4.
Back to the OWASP Testing Guide v4 ToC: https://www.owasp.org/index.php/OWASP_Testing_Guide_v4_Table_of_Contents Back to the OWASP Testing Guide Project: https://www.owasp.org/index.php/OWASP_Testing_Project
File Inclusion vulnerability allows an attacker to include a file, usually through a script on the web server. The vulnerability occurs due to the use of user-supplied input without proper validation. This can lead to something as minimal as outputting the contents of the file, but depending on the severity, to list a few it can lead to:
- Code execution on the web server
- Denial of Service (DoS)
- Sensitive Information Disclosure
Description of the Issue
Remote File Inclusion (also known as RFI) is ...
Black Box testing and example
To be continued.
Gray Box testing and example
How to protect yourself from RFI