php2shell-scan-batch
Reads a URL from each input row, scans it for the PHP2Shell vulnerability and adds the verdict to the row. The result is not stored; to record results, scan from the Scan Targets screen. Cancelling the query stops the request in flight at once.
php2shell-scan-batch [field=VALUE] [sapi=VALUE] [timeout=VALUE] [insecure=VALUE]
- field=VALUE
- Optional. Input field holding the URL. Default: url.
- sapi=VALUE
- Optional. Which crash signals count: auto (default) applies both mod_php and PHP-FPM rules, mod_php or fpm applies one set.
- timeout=VALUE
- Optional. Per-request read timeout in seconds. Default: 60.
- insecure=VALUE
- Optional. t skips TLS certificate verification, for internal assets with self-signed certificates. Default: f.
Output fields
| Field | Type | Name | Description |
|---|---|---|---|
| _time | Date | Scan time | Time the scan finished, e.g. 2026-10-24 13:05:00 |
| verdict | String | Verdict | e.g. VULNERABLE, FIXED, INCONCLUSIVE, NO_SIGNAL, ERROR |
| is_vulnerable | Boolean | Vulnerable | true when vulnerable, false when not, null when undecided, e.g. true |
| sapi | String | SAPI | e.g. mod_php, PHP-FPM, mod_php/PHP-FPM, unknown |
| powered_by | String | X-Powered-By | X-Powered-By response header, e.g. PHP/8.3.12 |
| php_version | String | PHP version | PHP version parsed from X-Powered-By, e.g. 8.3.12 |
| reason | String | Reason | Why the verdict was reached, e.g. probe 2 (8 MiB, 1020 parts) crashed the request handler |
| probe_count | Integer | Probes sent | Number of crafted probes sent (0-3), e.g. 3 |
| error | String | Error | Present only when the scan could not complete, e.g. control request failed: request timed out |