Use information disclosure to gather PHP configuration statistics

Avatar von Björn Schotte


Damien Seguy from nexen.net sent an e-mail with a notice about his newest statistics project: „PHP configuration statistics“. He gathered output of around 12,000 public available phpinfo() scripts.

Some of the results of his investigations:

Here are some funny and not so funny stats.

  • PHP admins likes to compile PHP in Summer
  • Register global is not dead
  • memory_limit is not used
  • PHP apps handle 100 Mb files

The first part of his article is online in English. Thank you Damien!

The not so funny side: please secure your phpinfo() output scripts! Either by using not so common script names like phpinfo.php, by protecting it through .htaccess or other mechanisms or by simply not uploading a phpinfo() script on your server.

Avatar von Björn Schotte

Kommentare

524 Antworten zu „Use information disclosure to gather PHP configuration statistics“

Schreibe einen Kommentar

Deine E-Mail-Adresse wird nicht veröffentlicht. Erforderliche Felder sind mit * markiert


Für das Handling unseres Newsletters nutzen wir den Dienst HubSpot. Mehr Informationen, insbesondere auch zu Deinem Widerrufsrecht, kannst Du jederzeit unserer Datenschutzerklärung entnehmen.