Blog Archives

PHP Easter Eggs / expose_php enabled

6/7/2011

The server is running the PHP programming language which is configured to expose details about the target host. This information may be useful to an attacker in determining the software versions installed.

Example HTTP response header:

X-Powered-By: PHP/5.4.16

Example URLs:

https://[target]/?=PHPE9568F35-D428-11d2-A769-00AA001ACF42
https://[target]/?=PHPB8B5F2A0-3C92-11d3-A3A9-4C7B08C10000
https://[target]/?=PHPE9568F34-D428-11d2-A769-00AA001ACF42

Recommendation:
Modify the php.ini file and set the directive 'expose_php' to 'Off' and restart the service.

Risk:
Low.

NSW Government ICT Services (SCM0020) approved supplier

OSI Security is an approved supplier to the Victorian Government

OSI Security is an approved supplier to the Queensland Government

OSI Security is an approved supplier to the New Zealand Government

External Penetration Testing
Managed Security Services
Source Code Review
Web Application Security Testing
Firewall Configuration and Rulesets
WiFi Access Point and Client Auditing
Forensics and Data Recovery
System Hardening and Configuration

Metasploit Pro
Tenable Nessus
Acunetix Web Scanner
Nexpose Vulnerability
Secunia Software Inspection
Elcomsoft Password Cracking
PortSwigger BurpSuite
HP Fortify

Contact
Clients
Advisories
Privacy policy
Ethics Statement
Disclosure Policy

OSI Security is proud to support a number of recognised charities, development projects and industry groups...

The Australian Computer Museum Society Incorporated

PHP Easter Eggs / expose_php enabled

Archives

Categories

OSI Security is proud to support a number of recognised charities, development projects and industry groups...