Regex Editor & Tester

Detects a specific PHP web shell/backdoor that may be disguised as a GIF image (GIF89 header). The shell is triggered when a request parameter equals 'kung', presents a file upload form, and uses @copy() with $_FILES to handle uploads. Contains Indonesian/Malay language success ('upload sukses') and failure ('upload gagal') messages, characteristic of Southeast Asian threat actor tools.