TL;DR:
1. bypass filter for `eval("return $_")` with `~` (not) operator2. abuse PHP FindFirstFile on Windows to read `c<<` aka `config.php`3. blind SSRF time-based SQL Injection with sqlmap and customized Gopherus