Disclose PHP source through an inclusion wrapper

Needs: A PHP inclusion sink accepts the filter wrapper and the process can read the source

Shell commands

# Baseline
curl -skG --data-urlencode 'page=php://filter/convert.base64-encode/resource=index.php' http://TARGET:PORT/index.php
printf '%s' 'BASE64_DATA' | base64 -d

Prerequisite: a PHP file-inclusion sink that accepts the wrapper. The encoded output must decode to target source; a normal rendered page means the wrapper did not disclose source in that context.

Verify → Decode the response and identify real target source; normal HTML rendering does not prove source disclosure.

If it fails → Wrapper filtering, missing path or a non-PHP read operation can defeat this route; retain ordinary traversal/source-disclosure evidence separately. More detail ↓

If → then

A secret-like value, key file, stored hash, challenge response or ticket → Classify the artifact and its identity context
Needs: Artifact provenance and format; possible local/domain/application identity and compatible protocol
A confirmed evaluating include and a log or file containing attacker-controlled bytes → Turn controlled local file content into inclusion execution
Needs: Controlled content survives logging; inclusion identity can read it; interpreter evaluates it; requested command facility is available
An input appears in a command-like operation or causes shell-dependent behavior → Prove visible or blind operating-system command injection
Needs: Input reaches command execution with an exploitable parsing boundary; process identity/runtime can perform the selected proof

No useful finding → another task in this topic. Failed check → resolve the failure before ruling out the path.

Explanation & examples

Disclose PHP source through an inclusion wrapper

USE WHEN: A PHP page/include parameter and possible access to local application files
STARTING ACCESS: A reproducible application request and a controlled input or access-context comparison
RESULT: Decoded application source without requiring its normal rendered behavior

Recognize the clue

Inspect the normal page selector, PHP technology evidence and any readable source/configuration clue obtained during mapping.

curl -sk -D - 'http://TARGET:PORT/index.php?page=about'

SYNTHETIC EXAMPLE OUTPUT

Normal link: index.php?page=about
Error for invalid page: include(PAGE.php): failed to open stream

Means: An include-related error suggests an evaluating PHP sink, unlike an ordinary file-download function.

Confirm: Verify that the actual sink accepts a filter wrapper and returns decodable target source; errors alone do not prove it.

After validation: The wrapper yields source that decodes correctly: use that source-disclosure method.
Ruled out in this context: The endpoint reads raw bytes through a wrapper-incompatible API: reject this PHP-inclusion hypothesis.
Still inconclusive: PHP branding without sink evidence leaves inclusion unproved; investigate normal request/source behavior first.

Troubleshooting: Wrapper filtering, missing path or a non-PHP read operation can defeat this route; retain ordinary traversal/source-disclosure evidence separately.

Additional prerequisite checks

curl -skG --data-urlencode 'page=php://filter/convert.base64-encode/resource=index.php' http://TARGET:PORT/index.php

Prerequisite: a PHP file-inclusion sink that accepts the wrapper. The encoded output must decode to target source; a normal rendered page means the wrapper did not disclose source in that context.

Why it works

The filter wrapper transforms file bytes before inclusion, allowing source disclosure instead of normal PHP evaluation. A generic file-download endpoint may not accept the same wrapper.

Worked example · hypothetical

Observation: direct inclusion renders a page. Test: request its base64-filtered source. Illustrative output: the decoded result contains database connection logic. Interpretation: follow the credential and use source to map the actual sink.

New identity, privilege, host or route? Re-enumerate → All topic tasks →

Study guide ↗Full procedure ↗Cheatsheet ↗