title: PHP - file_put_contents file manipulation
body: <p>I'm trying to write a PHP file on a server and to bypass the extension in the end.</p>
  
  <p>This is the PHP file - 1.php:</p>
  
  <pre><code>&lt;?php
  file_put_contents("folder\\".$GET['file'].".PNG",$_GET['content']);
  ?&gt;
  </code></pre>
  
  <p>I'm trying to bypass the PNG extension and to write a PHP file.
  like this:</p>
  
  <pre><code>1.php?file=attack.php%00&amp;content=blabla
  </code></pre>
  
  <p>but it's not working</p>
  
  <p>I tried:</p>
  
  <pre><code>Null char (%00,%u0000)
  
  Long filename
  
  CRLF chars
  
  space char
  
  ?,&amp;,|,&gt;,&lt;,(,),{,},[,],\,!,~,:,; chars
  
  backspace char
  
  ../
  </code></pre>
  
  <p>php protocol </p>
  
  <pre><code>php://filter/write=convert.base64-decode/resource=1.php
  </code></pre>
  
  <p>(will not work because the folder in the begging)</p>
  
  <p>Anyone have any idea?</p>
  
  <p>Thanks!</p>