Tuesday, May 22, 2007

PHP easter egg problem

PHP easter egg is funny dog picture but it could be used by attacker to detect PHP version
using following url:
http://www.yoursite.com/?=PHPE9568F36-D428-11d2-A769-00AA001ACF42
Each version has its own picture.
If you would like to hide PHP version or even the fact that your site are using PHP you could use following solutions :

  1. .htaccess mod_rewrite:
    Change mod_rewrite
    setting so that web
    server removes 'easter egg' parameter string

  2. modifying php.ini
    set the "expose_php"
    directive to "off" in
    server's php.ini

Contact me if you interested to make your site a
little safer.



No comments: