16

I'm bulding a website but some webtools and browser plugins allows anyone to get information on which technologies the website has been built. Is there any Alternative to not reveal that we are working on server that process php ?

2
23

Don't provide any information to anyone unless its absolutely necessary.

You should set expose_php=off in your PHP.ini. This tells PHP not to expose the "x-powered-by" HTTP header as well as the strange quarks that can be used to identify it. You should also set display_errors=Off which could be used to identify PHP as well as error-based vulnerabilities like SQL Injection. These two configurations should be used on all production systems. You can go a step further and remove or change the .php extension with mod_rewrite.

This is along the same lines as "banner information disclosure", which is revealing version information via service banners. You should be able to configure your HTTPD to suppress this information. In an Apache production environment set ServerTokens ProductOnly (thanks tftd). But this will just remove the version number, if you want to remove the word "apache" you have to use mod_security.

You could also lie >:). You can use mod_header to set any header, including a fake x-powered-by, and just adopt .aspx file extensions using mod_rewrite.

9
  • 6
    In addition to what you said, some variables like PHPSESSID should also be renamed. Using a URL rewrite scheme would also make guessing harder.
    – Dinu
    Feb 18 '13 at 20:05
  • 1
    In addition to both of you, if you're using apache, it's best practice to set ServerTokens ProductOnly
    – tftd
    Feb 18 '13 at 20:23
  • The expose_php=off will also hide the Easter egg query strings (not sure if that's what you meant by quirks).
    – detly
    Feb 18 '13 at 22:10
  • 4
    And hiding the tools used to build the site will not help with the 99.9999% of attacks which blindly fire exploits. Targeted attacks are not that common, and this is just security by obscurity.
    – symcbean
    Feb 19 '13 at 9:49
  • 1
    If you use APC you might need to change this variable: apc.rfc1867_name, if you use PHP Session upload check this variable: session.upload_progress.name Aug 28 '17 at 9:54
4

You can achieve a little more of security through obscurity by also tweaking the following values:

php_flag display_startup_errors off
php_flag display_errors off
php_flag html_errors off
php_value docref_root 0
php_value docref_ext 0

You can find some good advices here:

http://php.net/manual/en/security.hiding.php

6
  • Its not security though obscurity, its patching information disclosure vulnerabilities.
    – rook
    Feb 19 '13 at 18:57
  • @Rook I understand your point but I still consider this kind of tweak something which is related to security through obscurity.
    – LMGTFY
    Feb 19 '13 at 20:13
  • Just to clarify the precedent thouht: I think that If something was bullet-proof, you wouldn't care to hide or spoof this type of informations.
    – LMGTFY
    Feb 19 '13 at 20:26
  • 1
    I agree but this kind of preventive approach will only makes things harder for an attacker: if you use a vulnerable PHP version, hiding error messages and version number doesn't protect you from someone who tries to exploit the known vulnerability by trial (from which the definition of security through obscurity).
    – LMGTFY
    Feb 19 '13 at 20:48
  • 1
    If anything, you might want to continue to advertise your versions, so a) you remain highly aware of keeping tight version control in your infrastructure and b) maybe some nice white hat will alert you if you are vuln to some 0day attack. :-)
    – deed02392
    Feb 20 '13 at 15:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.