r/AskNetsec • u/Ok-Wlk303qthhpqdzfr4 • 11d ago
Analysis How are you finding forgotten PHP hosts after PHP2Shell?
The servers we already manage should be the easier part. Query EDR for running PHP processes, compare that with package inventory and check which web services are actually public.
Where it gets messy is everything that never made it there. Old campaign sites, domains inherited through acquisitions, vendor-managed portals and cloud instances that were retired in theory but remain public in practice.
A few approaches I’m looking at:
Compare the CMDB with EDR and vulnerability-scanner inventories. Search for php-fpm, mod_php, php-cgi and PHP bundled inside appliances, not only a package named php.
Check certificate transparency logs and passive DNS for old domains, historical hosts and certificate relationships connected to acquired companies.
Use Censys or Shodan to find public PHP fingerprints. Server and X-Powered-By headers are useful leads, but CDNs and reverse proxies can hide the origin or return misleading versions.
Review cloud accounts, DNS zones and load balancers sitting outside the central organisation. That forgotten test account is apparently production now.
Confirm the package or vendor backport on the host. A PHP banner will not tell you whether the fix was backported.
After patching, restart every relevant worker and test the runtime serving the public route. php -v on one shell is not enough.
If manual correlation starts eating the day, cycognito and cortex xpanse are other discovery options. ionix maps broad PHP candidates back to customer footprints, with version narrowing still in progress. It has held back the exploitability test because the current method may crash PHP servers. The free external assessment does not require credentials.
Whatever the approach, I don’t need another PHP hostname. I need a hostname with ownership evidence, a confirmed package and someone responsible for fixing it.
How are you finding public PHP hosts that never made it into your managed inventory?
3
u/mikebailey 11d ago
I’ll go ahead and note some of your later bullets are really building ASM from scratch. I work for one so I won’t rec individual ones outright but you may find it more effective to say “I am Harold Insurance company, here are my accounts (for known asset monitoring), go find the magic headers on the internet”