assetnote/php2shell-scanner

Installation

pip install -r requirements.txt

Usage

python3 scanner.py -u https://example.com

Requirements

• Python 3.9+

How It Works

The scanner sends a minimal multipart control request followed by up to three crafted multipart probes. The probes use PHP array keys nested 62 levels deep and increase from 1 MiB to 20 MiB, matching the detection logic used by Assetnote's internal scanner.

A target is reported vulnerable when the probe produces a PHP memory-exhaustion error, a differential empty HTTP 500, a PHP-FPM worker failure, or an advertised PHP version known to be unpatched. Initial 5xx responses, common request-rejection statuses, and nonempty HTTP 500 responses without the PHP fatal-error signature are not treated as crash signals.

The scanner tests /index.php by default. A path supplied in the URL is preserved, and --path or --path-file can test custom paths. phpMyAdmin targets are automatically retested at /showconfigerrors.php. Redirects are not followed unless --follow-redirects is set.

Options

-u, --url         Single URL to check
-l, --list        File containing hosts (one per line)
-t, --threads     Number of concurrent threads (default: 10)
--timeout         Request timeout in seconds (default: 60)
-o, --output      Output file for results (JSON)
--all-results     Save all results, not just vulnerable hosts
-k, --insecure    Disable TLS certificate verification
--follow-redirects Follow HTTP redirects (up to 10 hops)
-H, --header      Custom header (can be used multiple times)
-v,

Limitations

On specific PHP configurations, the scanner may report a false positive when its multipart probe exceeds PHP's memorylimit. Patched and vulnerable versions can then return the same empty HTTP 500 response.

This was reproduced on patched PHP 8.4.27 with memorylimit values from 2M to 32M, and on PHP 8.3.36 at 128M when maxmultipartbodyparts is set to 2785 or higher. The exact threshold may vary between builds.

When PHP does not disclose its version, the scanner cannot distinguish this safe post-patch OOM from the vulnerable pre-patch behavior. Results should therefore be verified against the installed PHP version and any vendor backports

SAPI Modes

The default --sapi auto mode applies both modphp and PHP-FPM verdict rules, matching the combined behavior of Assetnote's postmodules. Use --sapi modphp or --sapi fpm to restrict detection to a known SAPI.

Network Impact

Each tested path may receive a 42-byte control request and three probes totalling about 29 MiB. Probing stops as soon as the verdict is settled, and duplicate input URLs are scanned once.

Docker

Mount the current directory to read host lists and write results: