PHP2Shell Exposure Check

Open-source blue-team PHP2Shell exposure triage. Discover hostnames from certificate-transparency data and assess HTTP evidence for vulnerable PHP runtimes.

It reports affected candidates when disclosed version evidence is below a fixed release. For the exact registrable domain, it also checks exposed phpinfo() output for the PHP2Shell fix marker. A complete Core table without that marker plus an affected version is strong exposure evidence; a version alone remains a candidate because vendor backports can change the result. Hidden versions and server-side configuration can still make remote results inconclusive. The fix-marker method follows the non-invasive approach documented by PHP2Shell-Check.

Demo

The preview plays inline. Click it to open the full MP4 demo.

Requirements

• Node.js 20 or later
• npm

Run locally

npm install
npm start

Open http://127.0.0.1:3000. Set PORT to change the port. The server binds to 127.0.0.1 by default.

Discovery and live checks

• Accepts registrable domains such as example.com and site.com.mx, and public suffixes such as gob.mx and .mx.
• Registrable domains are discovered through Shodan CTL and crt.name. Public suffixes use Shodan CTL and crt.sh. A working source can still return results when another source fails; source errors are included in the response.
• Shodan CTL hostnames are selected first for live checks. For registrable domains, the queried domain is also included in the first batch; remaining slots use CTL hosts before fallback sources.
• Live checks run by default. Each scan selects up to 30 unique hosts per batch, for at most three batches (90 hosts total), and stops after the first batch with affected candidates.
• Checks use GET requests over HTTPS, falling back to HTTP if the HTTPS root request fails. The exact registrable domain also checks /phpinfo.php and /info.php for the fix marker; other hosts use version fingerprinting and PHP presence signals.
• Requests do not follow redirects and have a 4-second timeout. Responses are capped at 8 KB, except the two exact-domain phpinfo() checks, capped at 256 KB. DNS results that include non-public addresses are skipped.
• The exact-domain result separates a detected patch marker, a version-based affected candidate, and an inconclusive result. The scanner does not send exploit or behavioral probes; a hidden runtime requires host-side verification.
• The main table contains only affected candidates. Per-host probe evidence includes response status, protocol, checked paths, PHP signals, version source, and assessment. JSON and CSV exports are available.
• CT source responses are cached in process memory for 30 minutes (up to 64 entries). Live HTTP checks are performed on every scan.

The server binds to 127.0.0.1 by default. API requests must use a loopback Host and, when present, a matching same-origin Origin; this helps prevent other websites from triggering scans through a local browser. The existing rate limit and public-address checks also apply. No token or domain allowlist is required, and the API does not verify domain ownership. Only scan systems you are authorized to assess. Do not expose the service beyond localhost without adding a suitable network access control.

API

POST /api/lookup

Request body:

{
  "domain": "example.com",
  "activeCheck": true,
  "scanId": "optional-uuid"
}

activeCheck defaults to true. Set it to false for passive discovery without contacting discovered hosts. When scanId is provided, progress is available at GET /api/progress?id=<scanId>.

The response includes:

• findings: affected candidates during live checks, or a discovery sample in passive public-suffix mode
• checks: per-host live-check results and evidence
• stats: discovery and probe counts
• errors: unavailable CT sources, if any
• cves: advisory references

Other endpoint: GET /api/health.

Fixed releases

The current fixed releases used by the classifier are:

PHP branch	Fixed release
8.2	8.2.35
8.3	8.3.36
8.4	8.4.27
8.5	8.5.12

Older branches are treated as candidates with vendor backport status unknown. Verify the installed package with its vendor. See the PHP security advisory, CVE-2026-109618, and CVE-2026-109619.

Tests

npm test

The test suite covers domain normalization, CT parsing, PHP version classification, HTTP 200/403 handling, CT caching, batch limits, candidate filtering, and rejection of non-public IP addresses. GitHub Actions runs it on Node.js 20, 22, and 24 for pushes and pull requests.

Contributing

See CONTRIBUTING.md, the Code of Conduct, Support, and the Security Policy. Dependabot checks npm packages and GitHub Actions weekly.

License

This project is licensed under the MIT License. The adapted banner artwork is derived from DevCop95's MIT-licensed Shodan ReconsX artwork; see THIRD_PARTY_NOTICES.md.