php2shell-targets
Lists the registered scan targets of the caller's company with their latest verdict. Requires a logged-in session.
php2shell-targets [status=VALUE] [verdict=VALUE] [keyword=VALUE]
- status=VALUE
- Optional. Target status: ALIVE, UNREACHABLE or PENDING.
- verdict=VALUE
- Optional. Latest verdict: VULNERABLE, FIXED, INCONCLUSIVE, NO_SIGNAL, ERROR.
- keyword=VALUE
- Optional. Substring of the host, path, PHP version or X-Powered-By value.
Output fields
| Field | Type | Name | Description |
|---|---|---|---|
| host | String | Host | Target host, e.g. 192.0.2.10 |
| port | Integer | Port | Target port, 0 when scheme default, e.g. 8080 |
| scheme | String | Scheme | e.g. http, https |
| url | String | URL | Full target URL, e.g. https://192.0.2.10/ |
| status | String | Status | e.g. PENDING, ALIVE, UNREACHABLE |
| http_status | Integer | HTTP status | Root page HTTP status, e.g. 200 |
| last_verdict | String | Last verdict | e.g. VULNERABLE, FIXED, INCONCLUSIVE, NO_SIGNAL, ERROR |
| is_vulnerable | Boolean | Vulnerable | true when the last scan found it vulnerable, null if never scanned, e.g. false |
| php_version | String | PHP version | Advertised PHP version, e.g. 8.3.12 |
| powered_by | String | X-Powered-By | X-Powered-By header, e.g. PHP/8.3.12 |
| sapi | String | SAPI | e.g. mod_php, PHP-FPM, mod_php/PHP-FPM, unknown |
| last_scanned_at | Date | Last scanned | Last scan time, e.g. 2026-10-24 13:05:00 |