|
| ▲ | randomblock1 5 hours ago | parent | next [-] |
| $ curl -sS -D - -o /dev/null -X FOO https://stealmybitcoin.com/
HTTP/1.1 501 Not Implemented
Server: nginx
Date: Sat, 24 Oct 2026 22:06:58 GMT
Content-Type: text/html; charset=UTF-8
Content-Length: 495
Connection: keep-alive
Host: stealmybitcoin.com
X-Powered-By: PHP/8.4.26
|
| |
| ▲ | LZ2DMV 5 hours ago | parent [-] | | So expose_php is On and he filters X-Powered-By in the response when legal HTTP verbs are used, but nothing catches the illegal ones? Interesting. | | |
| ▲ | randomblock1 4 hours ago | parent [-] | | No, PHP's static handler (php_cli_server_begin_send_static) doesn't emit X-Powered-By but the error page handler (php_cli_server_send_error_page) always does. |
|
|
|
| ▲ | selfmodruntime 5 hours ago | parent | prev [-] |
| Fingerprinting for the PHP version, a proxy will tell you what it is most of the time as well. curl -sI http://stealmybitcoin.com/
HTTP/1.1 301 Moved Permanently
Server: nginx
Date: Sat, 24 Oct 2026 22:01:11 GMT
Content-Type: text/html
Content-Length: 162
Connection: keep-alive
Location: https://stealmybitcoin.com/
Edit: Not so easy for this. ProjectDiscovery's httpx could not find the php version. Interesting. |
| |
