Regex Tester & Validator

Detects the 'Tilak' PHP webshell/exploit embedded in GIF image polyglot files. Matches a GIF89 header (or junk/non-printable bytes), followed by HTML markup, then PHP code assigning hardcoded base64 payloads to $uexploit and $an0n_3xploiter variables, and executing them via eval(urldecode(base64_decode(...))) before exit. Used in malware scanners, WAF rules, and IDS signatures to identify this specific backdoor variant.