Web applications are the fundamental pillars of today's world. Society depends on them for business and day to day tasks. Because of their extensive use, web applications are under constant attack by hackers that exploit their vulnerabilities to disrupt business and thus access confidential information. Remote File Inclusion (RFI) is a type of vulnerability most often found on websites. It allows an attacker to include a remote file, usually through a script on the web server. The attackers operate independently of one another with the goal of seeking exploitable vulnerabilities on the web. Different reasons were found for attack such as use of user-supplied input without proper validation. This can lead to something as minimal as outputting the contents of the file or more serious events. From observations, it is apparent that the detection and blocking of such attacks can be prevented by creating a blacklist of attack sources and a black list of URLs of remotely included malicious scripts. Remote file inclusion is a technique which is used to attack web applications mainly php applications from a remote server. RFI attacks are extremely dangerous as they allow a client to force a vulnerable application to run their own malicious code by including a reference pointer to code from a URL located on a remote server. When an application executes the malicious code it may lead to a backdoor exploit or technical information retrieval. Attackers attempt to remotely include these within the web applications. While the scripts are hosted at many locations, many of them are duplicates of each other, so the number of actual scripts that are used in the attacks are very small.