Regex Tester & Validator

Matches PHP phishing kits (e.g., the 'tilak' kit) that harvest credentials by copying $_POST values into $_SESSION, compute MD5/base64 tokens, build a dynamic .html?$host redirect URL, and forward victims via header('Location:'). It tolerates a leading GIF89 image header plus junk/non-printable bytes before the opening PHP tag, catching scripts disguised as image uploads. Useful for malware scanners and WAFs inspecting uploaded files for phishing page handlers.