Introduction to PHP eggs information and methods to prevent leaks (hidden function) _php tips

Easter Eggs (Easter eggs) outside the pedestrian estimates do not understand this is a sacred tree, the internet explanation of eggs is: For computers, video games, computer games, DVDs or other interactive multimedia in the hidden functions or information. PHP contains a security vulnerability that could lead to unauthorized disclosure of information, and if you are running PHP, you may be able to find PHP versions and other sensitive information. I think it is necessary to solve this egg problem to ensure the security of your site.

How does the PHP egg work?

Whenever you run a PHP server, you can access any page by adding the following string to view the information after the domain name:

Copy Code code as follows:

? =phpb8b5f2a0-3c92-11d3-a3a9-4c7b08c10000 (PHP information list)
? =phpe9568f34-d428-11d2-a769-00aa001acf42 (PHP's logo)
? =phpe9568f35-d428-11d2-a769-00aa001acf42 (Zend LOGO)
? =phpe9568f36-d428-11d2-a769-00aa001acf42 (PHP LOGO blue Elephant)

Of course, if there is a loophole can be seen through the above to see information, now the general site has been blocked. However, if there is a description of the expose_php is enabled, PHP will generate the page to send out PHP version information, so some "bad guys" know your version number to use a known version of the vulnerability to attack.

How to stop the eggs

In general, if your server supports editing php.ini files, we can disable the expose_php in php.ini. If you can't manipulate the php.ini file, you can also screen by setting. htaccess.

Copy Code code as follows:

Rewritecond%{query_string} \=php[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12} [NC]
Rewriterule. *-[F]

Through the above two methods, we can block some PHP information, some server default settings expose_php is open, so the friends who came to see me this article had better shut it down.

Really appreciate it Jeff Starr ' s post expose_php, Easter Eggs, and. htaccess.

Example:

Copy Code code as follows:

http://wowo.haotui.com/space.php?=PHPB8B5F2A0-3C92-11d3-A3A9-4C7B08C10000
Http://en.wikipedia.org/w/index.php?=PHPE9568F34-D428-11d2-A769-00AA001ACF42
Http://www.zend.com/en/index.php?=PHPE9568F35-D428-11d2-A769-00AA001ACF42