maybe it's me, but i'm failing to see the "big picture" here as far as
security is concerned. It seems to me that this would only confirm to
the evil user that yes you are running php, thereby allowing him to
find php specific vulns?? Or is there something else i'm missing
here.

~Harrison

On Tue, 30 Nov 2004 06:12:00 +0200, Serban Gh. Ghita <serban (at) verasys (dot) ro [email concealed]> wrote:
> interesting, but very risking. i am wondering if an evil user could exploit
> this and create hoaxes using this 'easter eggs'
> i also wonder what impact could have this over the big companies websites
> that are using php ;-)
>
>
>
> Serban Gh. Ghita
> coordonator departament IT
> VERASYS International
> serban (at) verasys (dot) ro [email concealed]
> zamolxe (at) php (dot) net [email concealed]
> http://www.verasys.ro
> phone1: +40-251-406.152
> phone2: +40-251-406.153
> cell: +40-788.28.29.10
>
> ----- Original Message -----
> From: "Andi McLean" <andi_mclean (at) ntlworld (dot) com [email concealed]>
> To: <webappsec (at) securityfocus (dot) com [email concealed]>
> Sent: Sunday, November 28, 2004 3:21 PM
> Subject: Fwd: PHP Easter Eggs
>
> > Hi,
> >
> > Does anyone know about the easter eggs in PHP?
> > I've just found out about them, My trust in PHP has just had a major set
> back,
> > as I'm wondering what other easter eggs there are and can any be used to
> > circumenvent the protection I have on my site.
> > I feel like I now need to have a look at the source code, to find out what
> > else is there.
> >
> > <anywebsite.that/uses.php>?=PHPE9568F36-D428-11d2-A769-00AA001ACF42
> >
> > <anywebsite.thatuses.php>?=PHPB8B5F2A0-3C92-11d3-A3A9-4C7B08C10000
> >
> > <anywebsite.thatuses.php>?=PHPE9568F34-D428-11d2-A769-00AA001ACF42
> >
> > eg
> > www.jsane.com/index.php?=PHPE9568F36-D428-11d2-A769-00AA001ACF42
> > www.jsane.com/index.php?=PHPB8B5F2A0-3C92-11d3-A3A9-4C7B08C10000
> > www.jsane.com/index.php?=PHPE9568F34-D428-11d2-A769-00AA001ACF42
> >
> >
> > Andi
>
>

--
___________________________________
Harrison Gladden <hgladden (at) gmail (dot) com [email concealed]>
Computer Engineer & Science Major
~Past experience: He who never makes
mistakes, never did anything that's worth.~

[ reply ]