RE: PHP Easter Eggs

["V. Poddubnyy" <vpoddubniy () mail ru>]

Hello,

This thing at least shows PHP version installed on the server, so attacker
will be able to use some vulnerability that is not fixed in that version.

--
Best regards,
 Vladimir Poddubnyy

> -----Original Message-----
> From: Harrison Gladden [mailto:hgladden () gmail com] 
> Sent: Tuesday, November 30, 2004 5:41 AM
> To: Serban Gh. Ghita
> Cc: Andi McLean; webappsec () securityfocus com
> Subject: Re: PHP Easter Eggs
>
> maybe it's me, but i'm failing to see the "big picture" here 
> as far as security is concerned.  It seems to me that this 
> would only confirm to the evil user that yes you are running 
> php, thereby allowing him to find php specific vulns??  Or is 
> there something else i'm missing here.
>
> ~Harrison
>
> On Tue, 30 Nov 2004 06:12:00 +0200, Serban Gh. Ghita 
> <serban () verasys ro> wrote:
> > interesting, but very risking. i am wondering if an evil user could 
> > exploit this and create hoaxes using this 'easter eggs'
> > i also wonder what impact could have this over the big companies 
> > websites that are using php ;-)
> >
> >
> >
> > Serban Gh. Ghita
> > coordonator departament IT
> > VERASYS International
> > serban () verasys ro
> > zamolxe () php net
> > http://www.verasys.ro
> > phone1: +40-251-406.152
> > phone2: +40-251-406.153
> > cell: +40-788.28.29.10
> >
> > ----- Original Message -----
> > From: "Andi McLean" <andi_mclean () ntlworld com>
> > To: <webappsec () securityfocus com>
> > Sent: Sunday, November 28, 2004 3:21 PM
> > Subject: Fwd: PHP Easter Eggs
> >
> > > Hi,
> > >
> > > Does anyone know about the easter eggs in PHP?
> > > I've just found out about them, My trust in PHP has just 
> had a major 
> > > set
> > back,
> > > as I'm wondering what other easter eggs there are and can any be 
> > > used to circumenvent the protection I have on my site.
> > > I feel like I now need to have a look at the source code, to find 
> > > out what else is there.
> <anywebsite.that/uses.php>?=PHPE9568F36-D428-11d2-A769-00AA001ACF42
> > > <anywebsite.thatuses.php>?=PHPB8B5F2A0-3C92-11d3-A3A9-4C7B08C10000
> > >
> > > <anywebsite.thatuses.php>?=PHPE9568F34-D428-11d2-A769-00AA001ACF42
> > >
> > > eg
> > > www.jsane.com/index.php?=PHPE9568F36-D428-11d2-A769-00AA001ACF42
> > > www.jsane.com/index.php?=PHPB8B5F2A0-3C92-11d3-A3A9-4C7B08C10000
> > > www.jsane.com/index.php?=PHPE9568F34-D428-11d2-A769-00AA001ACF42
> > >
> > >
> > > Andi
>
>
> --
> ___________________________________
> Harrison Gladden <hgladden () gmail com>
> Computer Engineer & Science Major
> ~Past experience: He who never makes 
>    mistakes, never did anything that's worth.~