Attackers can use PHP eggs to obtain sensitive information.

Many old PHPer may have known or heard about the "PHP egg" statement. It seems that there was an egg as early as the PHP4 version, it may be gradually forgotten in recent years. In fact, the egg function is enabled by default in the PHP script engine.

Next we will use the Discuz official forum for a test:

 

 

 

Http://www.discuz.net /? = PHPE9568F34-D428-11d2-A769-00AA001ACF42

Http://www.discuz.net /? = PHPE9568F35-D428-11d2-A769-00AA001ACF42

Http://www.discuz.net /? = PHPE9568F36-D428-11d2-A769-00AA001ACF42

Http://www.discuz.net /? = PHPB8B5F2A0-3C92-11d3-A3A9-4C7B08C10000

The four links in red are the GUID values defined in PHP source code/ext/standard/info. h, as shown in

The PHP egg method has been used by some foreign Web vulnerability scanners (such as HP WebInspect) to detect the Web development language used by the websites to be scanned. In fact, during penetration testing, it is often difficult for some websites to identify which Web development language is used, because some websites use dynamic scripts to generate pure static HTML pages or use URL rewriting to implement pseudo staticPageIf the website is developed using PHP, you can try to use the egg detection method. In many cases, you can identify the egg function in php by default. ini is enabled. Of course, if you don't want others to obtain sensitive information about the website through an egg, you can use php. set expose_php to Off in ini!

 

After reading the above, some may say that sinceExpose_php = On in php. iniIt is not okay to capture the http header directly, but some large site Web servers have reverse proxy servers in front of them, so they cannot fully rely on capturing the information in the http header.

I wish you a happy Mid-Autumn Festival!

From: Sunge's Blog