Now that Null byte injections no longer work on PHP, what are the alternative attack strategies used by attackers for remote file inclusion ?
For RFI you don't need null byte, simply match the file extension on the remote file, inject a ? Which turns the extension into query string, use URL rewriting, etc, etc. For LFI however you may be able to pre-pend a number of ././ or /./. to cause the total path to be too long and php will truncate it. This is trickier as it is is length/offset dependent and you will need to brute force the length unless you know the local path and finally as you are padding by two bytes you may need an odd or even number of bytes in the filename for the truncation to align.