# RFI ( RFI -> RCE )

Similar to LFI, RFI fetches the documents from the specified url location, so what an attacker can do is,

1. Create a malicious php file
2. Host it in his local machine
3. Request the file with the URL
4. The php code will be executed and the output will be obtained
