[yolte]

Originally Posted by IrPr

c99 phpshells can be defected by some tricks because of using common GET args but r57 is more tricky and couldnt be defected without response body check
All phpshells based on malicious functions such exec, shell_exec, system, etc but we can catch local attackers with response body check

Thank you. I think disable_functions are nothing for a good hacker