Comment by LZ2DMV 13 hours ago I'm a bit curious how you found that. 5 comments LZ2DMV Reply randomblock1 13 hours ago $ curl -sS -D - -o /dev/null -X FOO https://stealmybitcoin.com/ HTTP/1.1 501 Not Implemented Server: nginx Date: Sat, 24 Oct 2026 22:06:58 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 495 Connection: keep-alive Host: stealmybitcoin.com X-Powered-By: PHP/8.4.26 LZ2DMV 13 hours ago So expose_php is On and he filters X-Powered-By in the response when legal HTTP verbs are used, but nothing catches the illegal ones? Interesting. randomblock1 12 hours ago No, PHP's static handler (php_cli_server_begin_send_static) doesn't emit X-Powered-By but the error page handler (php_cli_server_send_error_page) always does. selfmodruntime 13 hours ago Fingerprinting for the PHP version, a proxy will tell you what it is most of the time as well. curl -sI http://stealmybitcoin.com/ HTTP/1.1 301 Moved Permanently Server: nginx Date: Sat, 24 Oct 2026 22:01:11 GMT Content-Type: text/html Content-Length: 162 Connection: keep-alive Location: https://stealmybitcoin.com/ Edit: Not so easy for this. ProjectDiscovery's httpx could not find the php version. Interesting.
randomblock1 13 hours ago $ curl -sS -D - -o /dev/null -X FOO https://stealmybitcoin.com/ HTTP/1.1 501 Not Implemented Server: nginx Date: Sat, 24 Oct 2026 22:06:58 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 495 Connection: keep-alive Host: stealmybitcoin.com X-Powered-By: PHP/8.4.26 LZ2DMV 13 hours ago So expose_php is On and he filters X-Powered-By in the response when legal HTTP verbs are used, but nothing catches the illegal ones? Interesting. randomblock1 12 hours ago No, PHP's static handler (php_cli_server_begin_send_static) doesn't emit X-Powered-By but the error page handler (php_cli_server_send_error_page) always does.
LZ2DMV 13 hours ago So expose_php is On and he filters X-Powered-By in the response when legal HTTP verbs are used, but nothing catches the illegal ones? Interesting. randomblock1 12 hours ago No, PHP's static handler (php_cli_server_begin_send_static) doesn't emit X-Powered-By but the error page handler (php_cli_server_send_error_page) always does.
randomblock1 12 hours ago No, PHP's static handler (php_cli_server_begin_send_static) doesn't emit X-Powered-By but the error page handler (php_cli_server_send_error_page) always does.
selfmodruntime 13 hours ago Fingerprinting for the PHP version, a proxy will tell you what it is most of the time as well. curl -sI http://stealmybitcoin.com/ HTTP/1.1 301 Moved Permanently Server: nginx Date: Sat, 24 Oct 2026 22:01:11 GMT Content-Type: text/html Content-Length: 162 Connection: keep-alive Location: https://stealmybitcoin.com/ Edit: Not so easy for this. ProjectDiscovery's httpx could not find the php version. Interesting.
So expose_php is On and he filters X-Powered-By in the response when legal HTTP verbs are used, but nothing catches the illegal ones? Interesting.
No, PHP's static handler (php_cli_server_begin_send_static) doesn't emit X-Powered-By but the error page handler (php_cli_server_send_error_page) always does.
Fingerprinting for the PHP version, a proxy will tell you what it is most of the time as well.
Edit: Not so easy for this. ProjectDiscovery's httpx could not find the php version. Interesting.