I am working on a web application that would include some custom development and got a bit concerned about code theft.
So the question I wanted to ask is whether it is - generally speaking - possible to steal PHP or ASP code from a running web server using the HTTP or HTTPS protocols?
My understanding is that getting PHP/ASP files from a web server would require BOTH:
- that the attacker would have to get the server to somehow cough up files that it normally does not send to the client, and
- that the attacker is exploiting some security flaws in the web server software
I am mainly asking for confirmation that it is not possible to get PHP/ASP files through some "normal" operations (operations that does not require the use of unpatched security holes).
Also, if there is some (roundabout) way to retrieve these kind of files through HTTP or HTTPS without the use of security holes, what can to be done to block that?