19

I recently got a phishing mail of unusually bad quality; "Please imediatly sign in under the following link, as we are your bank, you know"-ish. The link points to an unconvincing URL with .php at the end.

I was asking myself why they might use a PHP script instead of just faking the look of the given page and submitting entered data to a form.

I don't really want to click the link to find out, but I would love to get to know what this PHP file is about to do. Is there a way of downloading the script, such as you could with the client-sided JavaScript?

Or am I not able to access the PHP file, as it is executed by the server?

Are there other ways of analyzing this file and its behavior without any danger?

  • 27
    A PHP file is executed server-side and CANNOT do anything to your web browser. What it can do is dynamically generate malicious client-side code which could cause issues for you. – MonkeyZeus Sep 3 '15 at 13:12
  • 8
    If you are looking to avoid having your web browser download and execute potentially malicious client-side code then you can use wget to download the output into a file which you can then open with Notepad. The only potential issue with this is that the PHP code might be able to detect that you are not using a web browser so it could merely output a blank file. You might need to send some headers which mimic a real UA-string. – MonkeyZeus Sep 3 '15 at 13:44
  • 3
    @Zaibis You're mostly correct. Technically a URL ending in ".php" could result in any code, not just PHP, being run. And technically a server could not respond to a request. Both scenarios are tho extremely rare. – Kenny Evitt Sep 3 '15 at 13:54
  • 13
    Nobody has yet said that accessing in any way an URL from spam (or something like it), especially if it contains an ID (theoretically an address without ID also can be sent only to you), can let the spammer/phisher know that you did it and encourage him to send more spam or sell your address to somebody else. Server can be configured to run some code when responding to any request, alse ending with ".html". – BartekChom Sep 3 '15 at 18:59
  • 2
    > "The link points to an unconvincing URL …" — there's no way to say Where the link actually points, the link's text says absolutely nothing about what will be done. It may end with .jpg, for example, and reply with an .exe file, or reply with HTTP redirect to arbitrary place. Behavior is only limited by the protocol, which is chosen by first word (http[s], ftp[s], etc…). And in any case, the server can know and store your IP address, and everything you've sent to it. – Sarge Borsch Sep 5 '15 at 13:12
64

If the server is configured correctly, you cannot download a PHP file. It will be executed when called via the webserver. The only way to see what it does is to gain access to the server via SSH or FTP or some other method.

This is because PHP is a serverside language, all the actions are performed on the server, then the result is sent to your browser (which is clientside).

If you are afraid to mess with your system, you could use Virtualbox with an Ubuntu VM and open the page from there. If you take a snapshot of the VM after installing, and before doing dangerous things, you can later go back to that snapshot and undo anything the script could have done to the VM.

  • Many phishing mails link to pages hosted on hacked websites with weak passwords, so maybe is possible to get access just guessing those. Of course you don't get too much with this. – Gustavo Rodrigues Sep 3 '15 at 12:45
  • 4
    If you want to get at what the server delivers without executing it in your VM's browser, you could use curl to download the HTML. You'd have to manually download any external files like CSS, JavaScript, and images, though. (That might not be a bad thing.) Strictly speaking, though the server could deliver something different based on the HTTP headers. Isn't it also possible that just by visiting the address you might be giving the attacker information they want: confirmation that there is a person at the destination address? (An identifier would have to be coded into the URL, of course.) – jpmc26 Sep 3 '15 at 21:15
  • I know a web server which had a bug at one point so that appending a space to the url would make it serve a script instead of executing it. – Carsten S Sep 4 '15 at 12:02
  • 3
    and undo anything the script could have done => apart from any network traffic that went out the VM, after all it's connected to Internet... – Matthieu M. Sep 4 '15 at 13:28
  • 1
    @GustavoRodrigues You don't get much with that, except for potential jail time for unauthorized access to a computer system. Don't try to access a potential compromised server. – Sumurai8 Sep 5 '15 at 14:07
11

As others have said, the PHP file is executed server-side, unless the server is so badly set up that it will simply serve the source.

If you would like to examine what is sent to your client without the possibility of it doing anything untoward, use a text editor like Notepad to open the URL. That is, use File → Open but open the URL rather than a real file.

The server will interpret the request and send what it would normally send to a browser. Your text editor will receive it, but all a text editor can do is display if for editing. It will never get near a browser or other rendering engine to be executed.

  • Awesome, such simplicity is often tough to think of. – TDsouza Sep 8 '15 at 10:28
  • @TDsouza not really because it doesn't make that clear that the PHP server side code will be deleted from the file if you look inside the php file that a client receives – barlop Jul 5 '16 at 19:51
  • PHP server-side code is not deleted. A PHP script directs server-side processing; server-side code is not sent to the client at all. This answer provides a means of examining what is actually sent to the browser, but without the risk of executing any client-side code. – Andrew Leach Jul 5 '16 at 21:21
2

No, you can't, because PHP is executed on the server. End.

  1. There is no need to get the code, because it's not executed on your computer, so there is no security risk for you.
  2. PHP will serve websites like any other, so that there is no PHP-specific answer.

    If you're interesed in a general answer, have a look at How do I safely inspect a suspicious email attachment? Its answers are also true for opening websites safely.
0

The .php file is executed on the server side so there is no way of getting the source code unfortunately. What you can try however is to manipulate the URL with the hope that the sysadmin made a mistake.

When a user visits http://www.example.com/index.php, the web server generates the HTML response by /usr/bin/php executing the index.php file from /var/www/html.

Web servers are typically configured to execute .php files only, so .jpg or any other file types are served as normal.

If a forgetful sysadmin made a copy of the .php file for backup purposes however, you might be able to retrieve the copy without being executed by /usr/bin/php

So if the sysadmin made a copy as /var/www/html/index.php.bak, you may download its source code by visiting http://www.example.com/index.php.bak with your browser.

Finding these leftover files is a cumbersome task, so you might want to have a look on automated URL fuzzing tools.

Finally I recommend using curl to make these experiments, because it won't execute JavaScript or Flash on your machine.

  • 1
    I once successfully used the "Emacs backup" trick - appending ~ to the filename, e.g. http://www.example.com/index.php~. I guess this is because the author of the attack gained SSH access and what he had at hand was either Vi or Emacs, and he was in the Emacs camp. And I've not see that many Apache servers configured to refuse serving '*~' files. – user58698 Sep 4 '15 at 12:04
0

You cannot via HTTP because

A)PHP code written in the file, is deleted from the file by the http server before it is sent to the http client

So an HTML form might reference blah.php which contains a php snippet, code surrounded with php tags, that checks if submitted password=1234 but if you were to wget blah.php you won't see that code. (even if the php supporting web server did let you get blah.php directly, without redirecting you to receive some other file.. it's not really the blah.php on the server that you are getting). It's blah.php processed by the server with php code removed and replaced with whatever the php outputted. Or with whatever client side code(html/javascript) the php code determined should be shown.

and

B)the HTTP server's php module will execute any php and produce the resultant file to send to the client.

By the way, technically an HTML file on a server can contain PHP. So it's not like PHP files are more dangerous than HTML files. PHP code does server processing and then outputs other client side stuff one may find in an HTML file like HTML or clients side javascript.

-4

Yes there is a way to get the PHP file.

You simply need to replace the protocol http or https with ftp.


example : http://www.facebook.com/profile.php replace by ftp://www.facebook.com/profile.php


It will download your PHP file if you enter your correct credential for ftp.

  • 2
    There is no guarante that the server will even support FTP or that the URL for the file will be the same. And even if it is, where would you get the credentials for the FTP? – Anders Oct 16 '18 at 13:42
  • 2
    That is not even close to work. Unless ftp is enabled AND the ftproot is the same as the DocumentRoot AND anonymous ftp is activated, it won't work. There's just a handful of places where it would work, so few that I would not mind to try. – ThoriumBR Oct 16 '18 at 13:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.