Nmap Security Scanner
*Intro
*Ref Guide
*Install Guide
*Download
*Changelog
*Book
*Docs
Security Lists
*Nmap Hackers
*Nmap Dev
*Bugtraq
*Full Disclosure
*Pen Test
*Basics
*More
Security Tools
*Pass crackers
*Sniffers
*Vuln Scanners
*Web scanners
*Wireless
*Exploitation
*Packet crafters
*More
Site News
Site Search:
Exploit World
Advertising
About/Contact
Credits
Sponsors:
edgeos



Vulnerability Development: Re: PHP and SCRIPT_NAME variable

Re: PHP and SCRIPT_NAME variable

From: <contact_at_eder-harald.com>
Date: 21 Feb 2006 22:00:18 -0000
('binary' encoding is not supported, stored as-is) Hi,

as far as I know the elements of the $_SERVER array are filled by the webserver and therefore a manipulation through a php trick might by difficult.

>From my opinion it will be easier to alter this values through a trick on the webserver for instance by using a bug in Apache but I do not know about any which might do this.

Anyway, its quite a interesting point of view because many php scripts use the $_SERVER['REMOTE_ADDR'] value for their session management und maybe some other array items too.

But it would be also quite interesting if php uses the items of this array to do something or if its just an array with no effect for the php scripts. Does anybody know more about this?
Received on Feb 21 2006

[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]
edgeos