> For the complete documentation index, see [llms.txt](https://dev-angelist.gitbook.io/writeups-and-walkthroughs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://dev-angelist.gitbook.io/writeups-and-walkthroughs/mutillidae-ii/idor-and-file-inclusion/web-shell-with-remote-file-inclusion-rfi.md).
# Web Shell with Remote File Inclusion (RFI)
## Lab 22: Insecure Direct Object Reference - Web Shell with Remote File Inclusion (RFI)
Go to lab page:
The idea is to upload via RFI a web shell to execute directly on the website vulnerable. In this case, i decided to utilize 'simple-backdoor.php'.
On the attacker machine (10.0.2.15) we can run a python web server using:
`python3 -m http.server 1339`
and reach it concatenating to IP:PORT file\_name and & cmd=command as below:
The correct answer is the last of the list: The plus symbol is the encoded character representing a space ' '. We have to encode the space character to prevent Apache web server from thinking the space marks the end of the URL.
