icon

Web PHP Pentesting

Last modified: 2024-05-17

Source Code Reveal

Try appending ~ suffix at the end of the php extension in path. This is the temporary file which is created by editors or version control systems so it’s worth try it to see the source code.

https://example.com/index.php~

Deobfuscate PHP Files with Syntax Highlighting

According to the PHP Manual, you might be able to deobfuscate php files by accessing with phps extension if the "highlight_file" is used in the target website.

https://vulnerable.com/index.phps