In this blog post, we describe new techniques to dump PHP files leveraging filters, and a tool that does it.

Scalpel is a Burp extension for intercepting and rewriting HTTP traffic, either on the fly or in the Repeater using Python 3 scripts.

We introduce a tool that uses PHP filters to wrap PHP resources in an arbitrary prefix and suffix.