![]() |
|
[Tutorial] Writing unreadable php scripts (Tips & Tricks) - Printable Version +- Hack Forums (https://hackforums.net) +-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45) +--- Forum: Grayhat • Purple Team • Hybrid Security (https://hackforums.net/forumdisplay.php?fid=449) +---- Forum: Website Hacking (https://hackforums.net/forumdisplay.php?fid=43) +---- Thread: [Tutorial] Writing unreadable php scripts (Tips & Tricks) (/showthread.php?tid=4403516) |
[Tutorial] Writing unreadable php scripts (Tips & Tricks) - Cybele - Aug 19, 2014 Ignore the shitty thread design, i'm bad at designs. I'm posting this thread for the Sonder challenge, which is located here: CLICK By the way, i'm writing this in this section, since this is very helpful when there's a waf that blocks your shit. This tutorial is for people that know php. Please don't ask me what eval does or something. Basically, we're trying to write a php script, that is extremely hard to read. We're going to be doing that using the brokenness of php. I'll just be giving you tips, tricks and examples. ^-^ Let's get to it. 1. Always write your 'obfuscated' scripts in one line. That way it really fucks with your eyes if there are like loops and shit. [img]http://i1070.photobucket.com/albums/u494/creamsocks/iHgo4Mn_zpsb80c7e69.png[/img] 2. PHP variable names can be ANY character. That means they can be retarded chinese characters, or invisible characters. For example, this works: PHP Code [img]http://i1070.photobucket.com/albums/u494/creamsocks/iHgo4Mn_zpsb80c7e69.png[/img] 3. You can select from arrays in several ways. array[0] is the same as array[0x0]. It just needs to be an integer in the end. For example, these scripts all work: Hex encoding: PHP Code PHP Code PHP Code PHP Code There are a lot of ways to do this, so feel free to experiment. Nothing is impossible in php lol. [img]http://i1070.photobucket.com/albums/u494/creamsocks/iHgo4Mn_zpsb80c7e69.png[/img] 4. Numbers. You can change numbers to their negative value just by using NOT, or ! PHP Code You can use hex instead of integers as we already said above. PHP Code [img]http://i1070.photobucket.com/albums/u494/creamsocks/iHgo4Mn_zpsb80c7e69.png[/img] 5. Double dollar signs. You can use double dollar signs, which is stupid, but still possible. You just have to silence the errors using @. PHP Code Just experiment. /thread * - coolerfarmer - Aug 19, 2014 nice tutorial! Thanks for sharing! There are some nice methods :P * - PsychoCookie - Aug 19, 2014 Awesome tut! Learned quite a few things here. If you use javascript you can use String.fromCharCode( you char code here for example 55, 23, 90) to hide your strings. * - Th3PonyWizard - Aug 19, 2014 Nice thread. I'd mention that writing a semicolon in a one liner PHP script before the closing tag (?>) isn't necessary, if you'd like to save as much characters as possible :P Good tutorial and glad you're participating in my challenge :D * - Cybele - Aug 19, 2014 Lol, this thread is getting burried to hell. |