PHP: Hiding PHP

User Contributed Notes
Hiding PHP

dimitar at bastun dot net
17-Jan-2005 12:13


In case there are an Internal Server error(error 500) using the old code below in an .htaccess file, you can replace it with the code modification that must solve the problem.



Old code

-----------



<Files ~ "^[^\.]+$">

       ForceType application/x-httpd-php

</Files>



Replacement of the code above(code modification)

------------------------------------------------------------



AddHandler server-parsed .php

<Files ~ "^[^\.]+$">

SetHandler application/x-httpd-php

</Files>



Regards,

Dimitar Tanev

Nikolai-Zujev-(at)-Gmail-dot-Com
22-Sep-2004 03:22


Assign files w/o extension to php interpreter

without using ReWrite module



[clip httpd.conf]



<Files ~ "^[^\.]+$">

        ForceType application/x-httpd-php

</Files>



[/clip]

php at vfmedia dot de
15-Jun-2004 09:21


I´ve found an easy way to hide php code and the uri is searchable by google and others...(only for unix or linux)



At first I have some rules in my hide.conf (i made an extra .conf for it (apache 2.0))



For example when I want to mask the index.php



<Files index>

 ForceType application/x-httpd-php

 </Files>



My problem is, that my code should be readable...



so I made an extra folder for example srv/www/htdocs/static_output



My phpcode is in the includefolder....(for ex. mnt/source/index.php)



Then I made a link in the shell  > ln mnt/source/index.php srv/www/htdocs/static_output/index



So the code is readable (with .php extension) in my includefolder and there is only the link in the srv folder without extension(which is called by the browser...).

12-May-2004 11:20


Keep in mind, if your really freaked out over hiding PHP, GD will expose you.



Go ahead - make an image with GD and open with a text editor.. Somewhere in there you'll see a comment with gd & php all over it.

php at user dot net
10-Apr-2004 09:36


What about this in a .htaccess file :



RewriteEngine on

RewriteRule    ^$    /index.php    [L]

RewriteRule    ^([a-zA-Z0-9\-\_/]*)/$    /$1/index.php    [L]

RewriteRule    ^([a-zA-Z0-9\-\_/]*)\.(html|htm)$    /$1.php    [L]

RewriteRule    ^([a-zA-Z0-9\-\_/]*)$    /$1.php    [L]



Typing "sub.domain.foo/anything" loads "/anything/index.php" if 'anything' is a directory, else it loads "/anything.php".



I'm sure you can find mutch better, but it works great on my site :)

mmj
14-Mar-2004 08:58


You can see if somebody's using PHP just by adding the following to the end of the URL:

?=PHPB8B5F2A0-3C92-11d3-A3A9-4C7B08C10000

If the page is using PHP, this will show the PHP credits.



Setting expose_php to Off in php.ini prevents this.

Elora at alexandria dot cc
13-Feb-2004 06:30


<bminton at efn dot org>'s suggestion won't work. All someone has to do is look at "foo.com/dir/" and try "foo.com/dir/index.html", "foo.com/dir/index.php", "foo.com/dir/index.cgi", until no 403/404 is returned.

ldemailly at qualysNOSPAM dot com
27-Oct-2003 11:17


adding MultiViews to your apache Options config

lets you hide/omit .php in the url without any rewriting, etc...

l0rdphi1 at liquefyr dot com
21-Jul-2003 07:02


More fun includes files without file extensions.



Simply add that ForceType application/x-httpd-php bit to an Apache .htaccess and you're set.



Oh yea, it gets even better when you play with stuff like the following:



substr($_SERVER['PATH_INFO'],1);



e.g. www.yoursite.com/somepage/55



And:



foreach ( explode('/',$_SERVER['PATH_INFO']) as $pair ) {

    list($key,$value) = split('=',$pair,2);

    $param[$key] = stripslashes($value);

}



e.g. www.yoursite.com/somepage/param1=value1/param2=value2/etc=etc



Enjoy =)

Bryce Nesbitt at Obviously.COM
27-Mar-2003 11:24


Using the .php extension for all your scripts is not necessary, and in fact can be harmful (by exposing too much information about your server, and by limiting what you can do in the future without breaking links). There are several ways to hide your .php script extension:



(1) Don't hard code file types at all.  Don't specify any dots, and most web servers will automatically find your .php, .html, .pdf, .gif or other matching file. This is called canonical URL format:

     www.xxxxxx.com/page

    www.xxxxxx.com/directory/

This gives you great flexibility to change your mind in the future, and prevents Windows browsers from making improper assumptions about the file type.



(2) In an Apache .htaccess file use:

    RewriteEngine on

    RewriteRule page.html page.php



(3) Force the webserver to interpret ALL .html files as .php:

    AddType application/x-httpd-php .php3 .php .html

bminton at efn dot org
27-Feb-2003 03:05


Another technique is to have every file be named index.php and be in it's own directory.  Then instead of using for instance http://my.site/foo.php you could use http://my.site/foo/ where foo is a directory with a file called index.php in it.

29-Jan-2003 01:53


PS. If you want to use pretty URLs (i.e. hide your .php extensions) AND you have safe-mode=on, the previous example (ForceType) won't work for you.  The problem is that safe-mode forces Apache to honor trailing characters in a requested URL.  This means that:



http://www.foo.com/home 



would still be processed by the home script in our doc root, but for:



http://www.foo.com/home/contact_us.html



apache would actually look for the /home/contact_us.html file in our doc root.



The best solution I've found is to set up a virtual host (which I do for everything, even the default doc root) and override the trailing characters handling within the virtual host.  So, for a virtual host listening on port 8080, the apache directives would look like this:



<VirtualHost *:8080>

    DocumentRoot /web/doc_root

    Alias /home "/web/doc_root/home.php"

    AcceptPathInfo On

</VirtualHost>



Some people might question why we are overriding the trailing characters handling (with the AcceptPathInfo directive) instead of just turning safe-mode=off.  The reason is that safe mode sets global limitations on the entire server, which can then be turned on or left off for each specific virtual host.  This is the equivilent of blocking all connections on a firewall, and then opening up only the ones you want, which is a lot safer than leaving everything open globally, and assuming your programmers will never overlook a possible security hole.

Azureash
27-Jan-2003 07:34


Another way to hide your .php extensions is to use the Apache ForceType directive (which is often referred to as pretty URLs.)  Basically you force Apache to parse a file as PHP that matches the trailing directory name in your URL.



For example, place this directive in your Apache httpd.conf file:

<Location /home>

     ForceType application/x-httpd-php

</Location>



and create a php file name "home" in your doc root.  This file should not have a .php extension, and can be a php template file.  Combined with a function to strip out URL parameters, this can create a new templating system, which can effectively hide your file extensions.



In this example,

http://www.foo.com/home/bar.html



would actually use the home script we created, and then the "bar.html" could be used to specify content to include.

Kevin Vincent
23-Jan-2003 08:43


Just a thought but if you have changed the extensions that php interprets I would assume you've also changed header.php and footer.php files to the new extension.



EG:



index.php, somefile.php, header.php, footer.php...



Change the Apache directive so PHP interprets .kev files and rename your files:



index.kev, somefile.kev, header.kev, footer.kev



If you leave header and footer as PHP files then it won't understand how to interpret them.

sth at panix dot com
04-Aug-2002 03:45


The flipside to this is, if you're running a version of 

PHP/Apache which is not known to have exploitable bugs (usually the latest stable version at the time), and an attacker sees this, they may give up before even trying. If they don't, they may continue to attempt their exploit(s).



It really depends on the type of attacker. The educated, security advisory reading attacker vs. script kiddie on the street.



If you're keeping up on patches, version exposition should not be a problem for you.

m1tk4 at hotmail dot com
22-Jul-2002 08:53


I usually do:



<code>

RewriteEngine on<br>

RewriteOptions inherit<br>

RewriteRule (.*)\.htm[l]?(.*) $1.php$2 [nocase]<br>

</code>



in .htaccess. You'll need mod_rewrite installed for this .

yasuo_ohgaki at yahoo dot com
26-Jan-2002 06:59


To hide PHP, you need following php.ini settings



expose_php=Off 

display_errors=Off



and in httpd.conf



ServerSignature Off

(min works, but I prefer off)

istvan dot takacsNOSPAM at hungax dot com
30-Dec-2001 12:42


And use the


ServerTokens min


directive in your httpd.conf to hide installed PHP modules in apache.

Chapter 32. Hiding PHP