php-payload-builder

Construct PHP payloads that bypass disable_functions for penetration testing.

1|Updated Jun 26, 2026

Search Tags:#penetration testing #bypass #PHP #payload #webshell

Ready to run

npx skills add https://github.com/xijunww/Pentest --skill php-payload-builder

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: php-payload-builder
Source: https://github.com/xijunww/Pentest/tree/main/packages/core/src/config/skills/builtin/php-payload-builder
Command: npx skills add https://github.com/xijunww/Pentest --skill php-payload-builder

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

This Skill helps to construct secure PHP payloads that can bypass security restrictions and allow for the execution of code within PHP environments.

Core Features & Use Cases

Payload Construction: Safely craft PHP payload code for various scenarios such as writing to PHP files, constructing webshells, and creating diagnostic pages.
Bypass Techniques: Provides methods to bypass common security measures like disable_functions and to handle shell escaping.
Use Case: When a penetration tester needs to write PHP code in a restricted environment using bash/shell and ensure that the PHP code will execute as intended.

Quick Start

Use the php-payload-builder skill to create a PHP payload for executing a command via 'echo "your_command_here"' in a PHP file.

Frequently Asked Questions about php-payload-builder

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I build a PHP payload to bypass disable_functions restrictions?▼

To build a PHP payload bypassing disable_functions, this Skill constructs secure PHP code utilizing various bypass techniques. It safely handles shell escaping and helps penetration testers execute intended commands in restricted PHP environments.

Can I generate a webshell using PHP when bash shell access is restricted?▼

Yes, you can generate a webshell using PHP when bash shell access is restricted. This Skill constructs payload code for writing to PHP files and building webshells, ensuring the PHP code executes as intended despite security measures.

What is the best way to execute code in a restricted PHP environment during penetration testing?▼

The best way to execute code in a restricted PHP environment during penetration testing is crafting secure PHP payloads. This Skill provides methods to bypass common security measures and safely construct diagnostic pages or webshells.

Does this PHP payload builder handle shell escaping for security research scenarios?▼

Yes, this PHP payload builder handles shell escaping for security research scenarios. It constructs secure PHP payloads designed to bypass restrictions and safely execute code, specifically targeting common security measures like disable_functions.

How to write PHP code in a restricted environment using bash to ensure execution?▼

To write PHP code in a restricted environment using bash and ensure execution, this Skill constructs tailored payloads. It supports creating diagnostic pages and webshells while handling shell escaping and bypassing disable_functions.

What are the limitations when constructing PHP payloads to bypass security restrictions?▼

When constructing PHP payloads to bypass security restrictions, the primary limitation is the target environment's specific configuration. This Skill is intended strictly for penetration testing and security research scenarios to safely handle common security measures.