capture PHP request to determine attacker's payload

gistfile1.txt

<?php

/* may be late but he can help others.
it's not my code, I get it from : 
https://gist.github.com/magnetikonline/650e30e485c0f91f2f40
*/

            class DumpHTTPRequestToFile {
                public function execute($targetFile) {
                    $data = sprintf(
                        "%s %s %s\n\nHTTP headers:\n",
                        $_SERVER['REQUEST_METHOD'],
                        $_SERVER['REQUEST_URI'],
                        $_SERVER['SERVER_PROTOCOL']
                    );
                    foreach ($this->getHeaderList() as $name => $value) {
                        $data .= $name . ': ' . $value . "\n";
                    }
                    $data .= "\nRequest body:\n";
                    file_put_contents(
                        $targetFile,
                        $data . file_get_contents('php://input') . "\n"
                    );
                    //echo("Done!\n\n");
                }
                private function getHeaderList() {
                    $headerList = [];
                    foreach ($_SERVER as $name => $value) {
                        if (preg_match('/^HTTP_/',$name)) {
                            // convert HTTP_HEADER_NAME to Header-Name
                            $name = strtr(substr($name,5),'_',' ');
                            $name = ucwords(strtolower($name));
                            $name = strtr($name,' ','-');
                            // add to list
                            $headerList[$name] = $value;
                        }
                    }
                    return $headerList;
                }
            }
            (new DumpHTTPRequestToFile)->execute('./registro.txt');

            // add this line at the end to create a file for each request with timestamp

            $fecha = "Content last changed: ".date("F d Y H:i:s.", filemtime("registro.txt"));

            $fp = fopen('registro.txt', 'a');//opens file in append mode  
            fwrite($fp, $fecha);  
            fclose($fp);  

            $date = new DateTime();
            rename("registro.txt", "registro-" . $date->format('Y-m-d-H:i:s') . ".txt");