assetnote/php2shell-scanner

选用指南

AI 根据 README 整理 · 2026/10/22 14:51:43

适用场景

适用于对 PHP 应用进行漏洞检测，可指定 SAPI 模式（mod_php 或 PHP-FPM）以匹配不同运行环境。

查看 README 依据

### SAPI Modes The default `--sapi auto` mode applies both mod_php and PHP-FPM verdict rules, matching the combined behavior of Assetnote's postmodules. Use `--sapi mod_php` or `--sapi fpm` to restrict detection to a known SAPI. ### Network Impact Each tested path may receive a 42-byte control request and three probes totalling about 29 MiB. Probing stops as soon as the verdict is settled, and duplicate input URLs are scanned once. ## Requirements - Python 3.9+ - h11 - tqdm ## Installation ``` pip install -r requirements.txt ``` ## Usage Scan a single host: ```

使用方式

通过命令行使用，支持单 URL、列表文件、多线程、自定义路径和自定义请求头。

查看 README 依据

python3 scanner.py -u https://example.com ``` Scan a list of hosts: ``` python3 scanner.py -l hosts.txt ``` Scan with multiple threads and save results: ``` python3 scanner.py -l hosts.txt -t 20 -o results.json ``` Scan with custom headers: ``` python3 scanner.py -u https://example.com -H "Authorization: Bearer token" -H "Cookie: session=abc" ``` Scan a custom path: ``` python3 scanner.py -u https://example.com --path /phpinfo.php python3 scanner.py -u https://example.com --path /index.php --path /admin.php python3 scanner.py -u https://example.com --path-file paths.txt ```

Use only PHP-FPM verdict rules: ``` python3 scanner.py -u https://example.com --sapi fpm ``` ## Options ``` -u, --url Single URL to check -l, --list File containing hosts (one per line) -t, --threads Number of concurrent threads (default: 10) --timeout Request timeout in seconds (default: 60) -o, --output Output file for results (JSON) --all-results Save all results, not just vulnerable hosts -k, --insecure Disable TLS certificate verification -H, --header Custom header (can be used multiple times)

部署要求

需要 Python 3.9+ 以及 h11 和 tqdm 库。

查看 README 依据

### SAPI Modes The default `--sapi auto` mode applies both mod_php and PHP-FPM verdict rules, matching the combined behavior of Assetnote's postmodules. Use `--sapi mod_php` or `--sapi fpm` to restrict detection to a known SAPI. ### Network Impact Each tested path may receive a 42-byte control request and three probes totalling about 29 MiB. Probing stops as soon as the verdict is settled, and duplicate input URLs are scanned once. ## Requirements - Python 3.9+ - h11 - tqdm ## Installation ``` pip install -r requirements.txt ``` ## Usage Scan a single host: ```

已知限制

不跟随重定向，且仅当探测产生特定错误信号时才判定为易受攻击。

查看 README 依据

A target is reported vulnerable when the probe produces a PHP memory-exhaustion error, a differential empty HTTP 500, a PHP-FPM worker failure, or an advertised PHP version known to be unpatched. Initial 5xx responses, common request-rejection statuses, and nonempty HTTP 500 responses without the PHP fatal-error signature are not treated as crash signals. The scanner tests `/index.php` by default. A path supplied in the URL is preserved, and `--path` or `--path-file` can test custom paths. phpMyAdmin targets are automatically retested at `/show_config_errors.php`. Redirects are not followed.