JoasASantos/php2shell-scanner

选用指南

AI 根据 README 整理 · 2026/10/22 07:21:19

使用方式

通过命令行使用，支持本地检查、远程扫描、子域名枚举、横幅抓取和可选的负载探测。

查看 README 依据

git clone https://github.com/JoasASantos/php2shell-scanner.git cd php2shell-scanner # stdlib only — no pip deps. # Optional recon fallback: ProjectDiscovery subfinder # brew install subfinder (or: go install github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest) ``` ## Usage ```bash # Local runtime check python3 php2shell_scan.py --local # Single remote target, look for exposed phpinfo() python3 php2shell_scan.py https://example.com --phpinfo-paths # Subdomain recon (crt.sh + subfinder) then scan, 10 threads, JSON out

python3 php2shell_scan.py example.com --recon --threads 10 -o out.json # Recon only, no scanning python3 php2shell_scan.py example.com --recon-only # Target list + forced robust banner grab python3 php2shell_scan.py -f targets.txt --banner # OPT-IN load probe (authorized use only — DoS risk) python3 php2shell_scan.py https://example.com --probe --probe-count 5 ``` ### Flags | Flag | Meaning | |------|---------| | `--local` | Local scan via the `php` binary | | `--recon` | Expand each domain into subdomains (crt.sh + subfinder), then scan resolving hosts |

部署要求

需要Python 3，仅使用标准库，无额外依赖。可选的子域名枚举回退需要安装ProjectDiscovery subfinder。

查看 README 依据

git clone https://github.com/JoasASantos/php2shell-scanner.git cd php2shell-scanner # stdlib only — no pip deps. # Optional recon fallback: ProjectDiscovery subfinder # brew install subfinder (or: go install github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest) ``` ## Usage ```bash # Local runtime check python3 php2shell_scan.py --local # Single remote target, look for exposed phpinfo() python3 php2shell_scan.py https://example.com --phpinfo-paths # Subdomain recon (crt.sh + subfinder) then scan, 10 threads, JSON out

已知限制

--probe模式可能导致拒绝服务，仅限授权使用。对于EOL版本（<8.2）无上游补丁，需检查发行版或OSV回移。

查看 README 依据

| `REMOTE` | Version fingerprint via `X-Powered-By` / `Server` headers and exposed `phpinfo()` | | `PRESENCE`| PHP detection without version (PHPSESSID, `.php` refs, redirects) | | `BANNER` | Robust raw-socket banner grab — HEAD/GET/OPTIONS + malformed probe, http/https, error-page disclosure | | `RECON` | Subdomain enumeration via **crt.sh** (Certificate Transparency) with **subfinder** fallback/merge, then fan-out scan resolving hosts | | `PROBE` | *(opt-in)* Large multipart requests to observe worker instability — **may cause DoS** | ## Install ```bash

Version comparison per branch against the `FIXED` table: - `< fixed` on a supported branch → **VULNERABLE** - `>= fixed` → **PATCHED** - `< 8.2` (EOL) → **VULNERABLE_EOL** (no upstream patch; check distro/OSV backport) - branch above advisory range or no version → **UNKNOWN** / **SUSPECTED** ## Authorization Run only against assets you own or are **explicitly permitted** to test. The `--probe` mode can disrupt fragile workers. You are responsible for your use. ## License MIT