从网站的PHP头或本地安装中获取基于版本的PHP2Shell警告.
概览
从网站的PHP头或本地安装中获取基于版本的PHP2Shell警告. 当您有服务器访问时使用 phpcheck- server , 或者当您只有 URL 时使用 phpcheck- url : 在机器可读输出时使用 --json 。 补丁 状态是好的, 可能存在的 vulnerable 或未知 。 无效的参数退出代码 2 。 所列上游固定值下方的版本可能变易返回和出口 1. PHP 5.4–5.6, 7.0–7.4, 8.0和8.1 也返回了这一警告,即使补丁号较高,如 8.1.35. URL模式读取了"X-Powered-By"和"Server",发送了"HEAD",只有在"HEAD"返回405或"501"时才返回到GET. 它不跟踪或检查反应机构。 缺少或隐藏的 PHP 信头返回 UNKNOWN 。 上游固定释放量为8.2.35、8.3.36、8.4.27和8.5.12,从10月21日的PHP咨询开始。 HTTP 信头无法分辨该版本是否包含一个后移植的修正. 甚至OK只描述了广告版本——它没有验证安装!
概述（AI 翻译）
从网站的PHP头或本地安装中获取基于版本的PHP2Shell警告.
要安装这两种技能,请询问 Codex:
有服务器时使用 phpcheck- server 访问, 或只有 URL 时的 phpcheck- url :
□ 直接运行
请检查access-date=中的日期值 (帮助) 网站:
□ 结果
====================================================================================================================================================================================
| – – – – – – – – – – – – –
QQ OK [T1] 广告版满足上游固定发布.
QQ POTENTIALLY VULNERABLE [T3] 广告版处于受影响范围.
QQ UNKNOWN QQ [T5] 缺少或未识别版本, 预放, 或失败检查. QQ
用于机器可读输出。 [[T7]为[T8],
[[T9]或[T10]]。 无效的参数退出代码 2 。
上游固定返回potentially_vulnerable
退出1。 PHP 5.4–5.6、7.0–7.4、8.0和8.1 也发回这一警告,甚至
且补丁编号较高,如: 8.1.35.
□ URL 检查
URL模式读取[[T14]和Server],发送HEAD,然后返回
GET只有在[T18]返回405或501时才进行. 它不遵循方向调整或
检查反应机构。 缺少或隐藏的 PHP 头返回 UNKNOWN。
上游固定释放量为8.2.35、8.3.36、8.4.27和8.5.
本页由 AI 翻译，技术细节请以原文为准。
README
PHP Version Checker
Get a version-based PHP2Shell warning from a website’s PHP headers or local installation.
To install both skills, ask Codex:
$skill-installer install both skills from https://github.com/openai/php2shell-checker
Use phpcheck-server when you have server access, or phpcheck-url when you only have a URL:
$phpcheck-url check https://example.com
$phpcheck-server check the PHP version serving my site
Run directly
Check a website:
node phpcheck.js "https://example.com"
Results
| Result | Exit code | Meaning |
|---|---|---|
OK |
0 |
Advertised version meets an upstream fixed release. |
POTENTIALLY VULNERABLE |
1 |
Advertised version is in an affected range. |
UNKNOWN |
3 |
Missing or unrecognized version, prerelease, or failed check. |
Use --json for machine-readable output. patch_status is ok,
potentially_vulnerable or unknown. Invalid arguments exit with code 2.
Versions below a listed upstream fix return potentially_vulnerable and
exit 1. PHP 5.4–5.6, 7.0–7.4, 8.0 and 8.1 also return this warning, even
with a higher patch number such as 8.1.35.
URL checks
URL mode reads X-Powered-By and Server, sends HEAD, and falls back to
GET only when HEAD returns 405 or 501. It does not follow redirects or
inspect response bodies. Missing or hidden PHP headers return UNKNOWN.
The upstream fixed releases are 8.2.35, 8.3.36, 8.4.27 and 8.5.12, from the
October 21 PHP advisory.
HTTP headers cannot tell whether the version contains a backported fix. Even OK
only describes the advertised version - it doesn’t verify the installation!
The checker does not send exploit probes.
Contributing
OpenAI is not accepting external code contributions to this project. Bug reports and non-code feedback are welcome through GitHub issues. See CONTRIBUTING.md.
License
This project is licensed under the Apache License 2.0.
推荐工具
换一个关键词，或者移除筛选条件。
安装
npx skillfish add openai/php2shell-checker