Testing for RFI
RFI is an attack that attempts to access external URLs and remotely located files. This kind of attack is possible due to parameter manipulation, a lack of server-side checks, and a lack of whitelisting for outbound traffic at the firewall level. These oversights may lead to data exfiltration of user information to external servers controlled by an attacker.
Getting ready
Using OWASP Mutillidae II as our target application, let’s determine whether it contains any RFI vulnerabilities.
Ensure Burp Suite and OWASP BWA VM are running and that Burp Suite is configured in the Firefox browser used to view the OWASP BWA applications.
How to do it...
- From the OWASP BWA landing page, click the link to the OWASP Mutillidae II application.
- Open the login screen of OWASP Mutillidae II in the Firefox browser. From the top menu, click Login.
- Find the request you just performed within the Proxy | HTTP history table. Look for the call to the
login...
