Remote File Inclusion (RFI)

Cross-platform resources for Remote File Inclusion (RFI): curated HTB machines, PortSwigger labs and TryHackMe rooms with validated writeups and related skills.

This page aggregates cross-platform resources to practice Remote File Inclusion (RFI): retired Hack The Box machines, PortSwigger Web Security Academy labs and TryHackMe rooms, plus curated resources (HackTricks, PortSwigger, etc.) and related skills.

Coverage: 6 challenges across 2 platforms — 4 HackTheBox · 2 TryHackMe. 4 with a Spanish writeup, 4 with a video writeup.

Where to start

Ordered by actual difficulty. At the same level: isolated lab first, then the guided room, and the full machine last.

1. TryHackMe — File Inclusion (Medium · ~60 min) · 🇬🇧
2. HackTheBox — Sniper (Medio) · 🇪🇸 🇬🇧 📹
3. HackTheBox — StreamIO (Medio) · 🇪🇸 🇬🇧 📹
4. HackTheBox — TartarSauce (Medio) · 🇪🇸 🇬🇧 📹
5. TryHackMe — The Bandit Surfer (Hard · ~120 min) · 🇬🇧
6. HackTheBox — Fulcrum (Insano) · 🇪🇸 🇬🇧 📹

Curated resources

Source	Link
HackTricks	https://book.hacktricks.wiki/en/pentesting-web/file-inclusion/index.html

HTB machines practicing Remote File Inclusion (RFI) (4)

Machine	OS	Difficulty	Writeup
Fulcrum	Linux	INSANE	🇪🇸 🇬🇧 📹
Sniper	Windows	MEDIUM	🇪🇸 🇬🇧 📹
StreamIO	Windows	MEDIUM	🇪🇸 🇬🇧 📹
TartarSauce	Linux	MEDIUM	🇪🇸 🇬🇧 📹

TryHackMe rooms practicing Remote File Inclusion (RFI) (2)

Room	Difficulty	Type	Access	Official
File Inclusion	MEDIUM	Walkthrough	🔵 VIP	Open
The Bandit Surfer	HARD	Challenge	🟢 Free	Open

Related skills

• /en/skills/lfi
• /en/skills/rce

---

← Back to the full glossary

Last updated: 2026-08-17