Description:
------------
The test script contains a HTML form that will send the parameter POST key to the php file where backend script and the form is located.

If the key matches the secret variable It will print Logged in, otherwise It'll print Permission denied.

The only way to access this "secret" variable is to scan the web server for vulnerabilities, but there is a way with the PHP built-in webserver.

Lets say the location of the script is located at /admin.php and only the Administrator of that page knows the secret, which is embedded into the PHP script.

If he is port forwarding the PHP Built-in server to the public world then we are in a position to actually see the source code, but of course this doesn't have to be public it can be a user on a local network running the server without firewall rules to block outsiders.

So, we have /admin.php on the server but If we open a new tab and replace it with /admin.PHP the server outputs the source code of the script and thus giving us the ability to see whats inside $secret variable.

Test script:
---------------
<form action="" method="POST">
  <input name="key">
  <input type="submit">
</form>
<?php
$secret = '0x000000f'; // random key
if ($_POST) {
  $key = $_POST['key'];
  if ($key == $secret) {
    printf("Logged in!");
  } else {
    printf("Permission denied.");
  }
}
?>

Description:
------------
The test script contains a HTML form that will send the parameter POST key to the php file where backend script and the form is located.

If the key matches the secret variable It will print Logged in, otherwise It'll print Permission denied.

The only way to access this "secret" variable is to scan the web server for vulnerabilities, but there is a way with the PHP built-in webserver.

Lets say the location of the script is located at /admin.php and only the Administrator of that page knows the secret, which is embedded into the PHP script.

If he is port forwarding the PHP Built-in server to the public world then we are in a position to actually see the source code, but of course this doesn't have to be public it can be a user on a local network running the server without firewall rules to block outsiders.

So, we have /admin.php on the server but If we open a new tab and replace it with /admin.PHP the server outputs the source code of the script and thus giving us the ability to see whats inside $secret variable.

Test script:
---------------
<form action="" method="POST">
  <input name="key">
  <input type="submit">
</form>
<?php
$secret = '0x000000f'; // random key
if ($_POST) {
  $key = $_POST['key'];
  if ($key == $secret) {
    printf("Logged in!");
  } else {
    printf("Permission denied.");
  }
}
?>

> If he is port forwarding the PHP Built-in server to the public world

than he is a fool because the builtin websevrer is for development only and MUST NOT be exposed to the internet

https://www.php.net/manual/en/features.commandline.webserver.php

The very first thing on the page:
> Warning
> This web server was designed to aid application development. It may also be useful for testing purposes or for
> application demonstrations that are run in controlled environments. It is not intended to be a full-featured web
> server. It should not be used on a public network.

With that said, I see no reason why the server couldn't recognize "php" case-insensitively, and if it does then it should recognize the other extensions insensitively too.

Yes but the only file contained inside the folder is admin.php, no admin.PHP just admin.php but the built-in server doesn't execute .PHP as a script but rather proceeds to output the source code.

> Yes but the only file contained inside the folder is admin.php,
> no admin.PHP just admin.php but the built-in server doesn't
> execute .PHP as a script but rather proceeds to output the source
> code.

That only happens with case-insensitive file systems, though.

null