Comment by randomblock1

13 hours ago

It runs PHP 8.4.26 (and nginx). Might be useful for others.

Also, the only pages I found are static and not an actual PHP entry point. If it doesn't run any PHP, it's not vulnerable to PHP2Shell. At least I think that's how it works.

6 comments

randomblock1

Reply
LZ2DMV  12 hours ago

I'm a bit curious how you found that.

  • randomblock1  12 hours ago 

      $ curl -sS -D - -o /dev/null -X FOO https://stealmybitcoin.com/
  HTTP/1.1 501 Not Implemented
  Server: nginx
  Date: Sat, 24 Oct 2026 22:06:58 GMT
  Content-Type: text/html; charset=UTF-8
  Content-Length: 495
  Connection: keep-alive
  Host: stealmybitcoin.com
  X-Powered-By: PHP/8.4.26

    • LZ2DMV  12 hours ago

      So expose_php is On and he filters X-Powered-By in the response when legal HTTP verbs are used, but nothing catches the illegal ones? Interesting.

      1 reply →

  • selfmodruntime  12 hours ago

    Fingerprinting for the PHP version, a proxy will tell you what it is most of the time as well.

      curl -sI http://stealmybitcoin.com/
  HTTP/1.1 301 Moved Permanently
  Server: nginx
  Date: Sat, 24 Oct 2026 22:01:11 GMT
  Content-Type: text/html
  Content-Length: 162
  Connection: keep-alive
  Location: https://stealmybitcoin.com/

    Edit: Not so easy for this. ProjectDiscovery's httpx could not find the php version. Interesting.