[Cybele]

Ignore the shitty thread design, i'm bad at designs.
I'm posting this thread for the Sonder challenge, which is located here: CLICK
By the way, i'm writing this in this section, since this is very helpful when there's a waf that blocks your shit. This tutorial is for people that know php. Please don't ask me what eval does or something.

Basically, we're trying to write a php script, that is extremely hard to read.
We're going to be doing that using the brokenness of php.
I'll just be giving you tips, tricks and examples. ^-^
Let's get to it.

1. Always write your 'obfuscated' scripts in one line. That way it really fucks with your eyes if there are like loops and shit.

[img]http://i1070.photobucket.com/albums/u494/creamsocks/iHgo4Mn_zpsb80c7e69.png[/img]

2. PHP variable names can be ANY character. That means they can be retarded chinese characters, or invisible characters. For example, this works:

PHP Code


<?php $‌="I'm gay."; echo($‌); ?>

[img]http://i1070.photobucket.com/albums/u494/creamsocks/iHgo4Mn_zpsb80c7e69.png[/img]

3. You can select from arrays in several ways. array[0] is the same as array[0x0]. It just needs to be an integer in the end.
For example, these scripts all work:

Hex encoding:

PHP Code


<?php $x=["I'm","gay."]; echo($x[0x0]); ?>

XOR encoding:

PHP Code


<?php $x=["I'm","gay."]; echo($x[(("."^"`")^"~")]); ?>

Equations:

PHP Code


<?php $x=["I'm","gay."]; echo($x[6*9-54]); ?>

Other vars:

PHP Code


<?php $x=["I'm","gay."]; $z=5*5; echo($x[$z-25]); ?>

There are a lot of ways to do this, so feel free to experiment. Nothing is impossible in php lol.

[img]http://i1070.photobucket.com/albums/u494/creamsocks/iHgo4Mn_zpsb80c7e69.png[/img]

4. Numbers.
You can change numbers to their negative value just by using NOT, or !

PHP Code


<?php $x=!0; echo($x); ?>

//Echos out 1
You can use hex instead of integers as we already said above.

PHP Code


<?php $x=0x69; echo($x); ?>

//Echos out 105 lol.

[img]http://i1070.photobucket.com/albums/u494/creamsocks/iHgo4Mn_zpsb80c7e69.png[/img]

5. Double dollar signs. You can use double dollar signs, which is stupid, but still possible. You just have to silence the errors using @.

PHP Code


<?php @$$S="I'm gay."; echo(@$$S); ?>

There are a lot more ways to make your php scripts as messy as possible.
Just experiment.
/thread

[PsychoCookie]

Awesome tut! Learned quite a few things here.
If you use javascript you can use String.fromCharCode( you char code here for example 55, 23, 90) to hide your strings.

[Th3PonyWizard]

Nice thread. I'd mention that writing a semicolon in a one liner PHP script before the closing tag (?>) isn't necessary, if you'd like to save as much characters as possible :P
Good tutorial and glad you're participating in my challenge :D

[Cybele]

Lol, this thread is getting burried to hell.