Re: PHP Easter Eggs

[Antonio Varni <antonio.varni () gmail com>]

Besides acting as another fingerprinting method, unexpected output
like this could cause faults in other application's parsing routines.
For example a brittle front end application that later queries a php
server (that could be influenced to pass along this URL) might crash
any number of ways.  This could serve as a simple DOS, or expose
sensitive information if the errors are displayed to the attacker.

Might be a bit of a stretch, but unexpected behavior like this can act
an attack vector in a larger attack.


On Mon, 29 Nov 2004 20:40:41 -0600, Harrison Gladden <hgladden () gmail com> wrote:
> maybe it's me, but i'm failing to see the "big picture" here as far as
> security is concerned.  It seems to me that this would only confirm to
> the evil user that yes you are running php, thereby allowing him to
> find php specific vulns??  Or is there something else i'm missing
> here.
>
> ~Harrison
>
>
>
> On Tue, 30 Nov 2004 06:12:00 +0200, Serban Gh. Ghita <serban () verasys ro> wrote:
> > interesting, but very risking. i am wondering if an evil user could exploit
> > this and create hoaxes using this 'easter eggs'
> > i also wonder what impact could have this over the big companies websites
> > that are using php ;-)
> >
> >
> >
> > Serban Gh. Ghita
> > coordonator departament IT
> > VERASYS International
> > serban () verasys ro
> > zamolxe () php net
> > http://www.verasys.ro
> > phone1: +40-251-406.152
> > phone2: +40-251-406.153
> > cell: +40-788.28.29.10
> >
> > ----- Original Message -----
> > From: "Andi McLean" <andi_mclean () ntlworld com>
> > To: <webappsec () securityfocus com>
> > Sent: Sunday, November 28, 2004 3:21 PM
> > Subject: Fwd: PHP Easter Eggs
> >
> > > Hi,
> > >
> > > Does anyone know about the easter eggs in PHP?
> > > I've just found out about them, My trust in PHP has just had a major set
> > back,
> > > as I'm wondering what other easter eggs there are and can any be used to
> > > circumenvent the protection I have on my site.
> > > I feel like I now need to have a look at the source code, to find out what
> > > else is there.
> > >
> > > <anywebsite.that/uses.php>?=PHPE9568F36-D428-11d2-A769-00AA001ACF42
> > >
> > > <anywebsite.thatuses.php>?=PHPB8B5F2A0-3C92-11d3-A3A9-4C7B08C10000
> > >
> > > <anywebsite.thatuses.php>?=PHPE9568F34-D428-11d2-A769-00AA001ACF42
> > >
> > > eg
> > > www.jsane.com/index.php?=PHPE9568F36-D428-11d2-A769-00AA001ACF42
> > > www.jsane.com/index.php?=PHPB8B5F2A0-3C92-11d3-A3A9-4C7B08C10000
> > > www.jsane.com/index.php?=PHPE9568F34-D428-11d2-A769-00AA001ACF42
> > >
> > >
> > > Andi
>
>
> --
> ___________________________________
> Harrison Gladden <hgladden () gmail com>
> Computer Engineer & Science Major
> ~Past experience: He who never makes
>    mistakes, never did anything that's worth.~