Did you know remote and local file inclusion (RFI/LFI) was among the four most prevalent Web application attacks in 2011? Why is RFI/LFI so attractive to hackers? Quite simply, with RFI/LFI a hacker can take over a Web server. RFI and LFI attacks primarily affect Web applications written in the PHP programming language. PHP is the most popular server-side programming language. In fact, PHP is used by 77.2% of today’s Web sites. This presentation looks at how hackers use RFI/LFI and avoid traditional detection techniques.