Hiding PHP
Hiding PHP
========
Using some simple techniques to hide PHP, possibly slowing down an attacker who is attempting to discover weaknesses in your system.
By setting expose_php = off in your php.ini file, you can reduce the amount of information available to them.
Another method is to configure web servers such as apache to parse different filetypes through PHP, either with an .htaccess directive, or in the apache configuration file itself. You can then use misleading file extensions:
Example
======
Hiding PHP as another language
# Make PHP code look like other code types
AddType application/x-httpd-php .asp .py .pl
Example
======
Using unknown types for PHP extensions
# Make PHP code look like unknown types
AddType application/x-httpd-php .bop .foo .133t
Example
======
Using HTML types for PHP extensions
# Make all PHP code look like HTML
AddType application/x-httpd-php .htm .html
