Friday, December 1. 2006
The good thing about images is that JavaScript can check if they are loaded and what size they are. With this ability it is trivial to detect if PHP is running on an URL if expose_php=On.
Here is the little proof of concept:
<html><head><title>Detect PHP Version by JavaScript</title>
<script>
function fail()
{
alert("URL is not powered by PHP or expose_php=off");
}
function detect()
{
if (xxx.width == 100 && xxx.height==58) {
alert("URL is powered by PHP 4");
} else if (xxx.width == 113 && xxx.height==72) {
alert("URL is powered by PHP 5");
} else {
alert("No PHP or unknown PHP version");
}
}
</script></head>
<body>
<img
src="http://URL/?=PHPE9568F35-D428-11d2-A769-00AA001ACF42"
onerror="fail()" name=xxx onload="detect()">
</body>
</html>
Update: I changed the example because it actually did not work. I had rewritten it in the blog to get around displaying problems. Therefore the previous example simply did not work.
Update-2: In one of the comments I was advised to simply use telnet and check the HTTP headers for the PHP version instead of JavaScript. The problem is that the poster misunderstood that all these JavaScript scanning tricks are things a malicious piece of JavaScript forces YOUR browser to do. This means YOUR browser executes the scan for PHP in your internal company network and sends information back to MY website. And after that I will know how YOUR internal company network is structured and if YOUR internal servers are running PHP or not.
