Ignore the shitty thread design, i'm bad at designs.
I'm posting this thread for the Sonder challenge, which is located here: CLICK
By the way, i'm writing this in this section, since this is very helpful when there's a waf that blocks your shit. This tutorial is for people that know php. Please don't ask me what eval does or something.
Basically, we're trying to write a php script, that is extremely hard to read.
We're going to be doing that using the brokenness of php.
I'll just be giving you tips, tricks and examples. ^-^
Let's get to it.
1. Always write your 'obfuscated' scripts in one line. That way it really fucks with your eyes if there are like loops and shit.
[img]http://i1070.photobucket.com/albums/u494/creamsocks/iHgo4Mn_zpsb80c7e69.png[/img]
2. PHP variable names can be ANY character. That means they can be retarded chinese characters, or invisible characters. For example, this works:
[img]http://i1070.photobucket.com/albums/u494/creamsocks/iHgo4Mn_zpsb80c7e69.png[/img]
3. You can select from arrays in several ways. array[0] is the same as array[0x0]. It just needs to be an integer in the end.
For example, these scripts all work:
Hex encoding:
XOR encoding:
Equations:
Other vars:
There are a lot of ways to do this, so feel free to experiment. Nothing is impossible in php lol.
[img]http://i1070.photobucket.com/albums/u494/creamsocks/iHgo4Mn_zpsb80c7e69.png[/img]
4. Numbers.
You can change numbers to their negative value just by using NOT, or !
//Echos out 1
You can use hex instead of integers as we already said above.
//Echos out 105 lol.
[img]http://i1070.photobucket.com/albums/u494/creamsocks/iHgo4Mn_zpsb80c7e69.png[/img]
5. Double dollar signs. You can use double dollar signs, which is stupid, but still possible. You just have to silence the errors using @.
There are a lot more ways to make your php scripts as messy as possible.
Just experiment.
/thread
I'm posting this thread for the Sonder challenge, which is located here: CLICK
By the way, i'm writing this in this section, since this is very helpful when there's a waf that blocks your shit. This tutorial is for people that know php. Please don't ask me what eval does or something.
Basically, we're trying to write a php script, that is extremely hard to read.
We're going to be doing that using the brokenness of php.
I'll just be giving you tips, tricks and examples. ^-^
Let's get to it.
1. Always write your 'obfuscated' scripts in one line. That way it really fucks with your eyes if there are like loops and shit.
[img]http://i1070.photobucket.com/albums/u494/creamsocks/iHgo4Mn_zpsb80c7e69.png[/img]
2. PHP variable names can be ANY character. That means they can be retarded chinese characters, or invisible characters. For example, this works:
PHP Code
<?php $="I'm gay."; echo($); ?>[img]http://i1070.photobucket.com/albums/u494/creamsocks/iHgo4Mn_zpsb80c7e69.png[/img]
3. You can select from arrays in several ways. array[0] is the same as array[0x0]. It just needs to be an integer in the end.
For example, these scripts all work:
Hex encoding:
PHP Code
<?php $x=["I'm","gay."]; echo($x[0x0]); ?>PHP Code
<?php $x=["I'm","gay."]; echo($x[(("."^"`")^"~")]); ?>PHP Code
<?php $x=["I'm","gay."]; echo($x[6*9-54]); ?>PHP Code
<?php $x=["I'm","gay."]; $z=5*5; echo($x[$z-25]); ?>There are a lot of ways to do this, so feel free to experiment. Nothing is impossible in php lol.
[img]http://i1070.photobucket.com/albums/u494/creamsocks/iHgo4Mn_zpsb80c7e69.png[/img]
4. Numbers.
You can change numbers to their negative value just by using NOT, or !
PHP Code
<?php $x=!0; echo($x); ?>You can use hex instead of integers as we already said above.
PHP Code
<?php $x=0x69; echo($x); ?>[img]http://i1070.photobucket.com/albums/u494/creamsocks/iHgo4Mn_zpsb80c7e69.png[/img]
5. Double dollar signs. You can use double dollar signs, which is stupid, but still possible. You just have to silence the errors using @.
PHP Code
<?php @$$S="I'm gay."; echo(@$$S); ?>Just experiment.
/thread
