PHP2Shell Scanner

Everything the screens do can also be done from a query. A query is handier when you pull a list of web servers out of other data and register them in one go, or aggregate the result history into a report. The full options and output fields of each command are under Extension Commands.

Listing targets - php2shell-targets

Show only the targets whose latest verdict is vulnerable.

php2shell-targets verdict=VULNERABLE

Filter with status, verdict and keyword; the rows carry the same information as the screen list.

Aggregating the result history - php2shell-results

Count the vulnerable results of the last 7 days per PHP version.

php2shell-results duration=7d verdict=VULNERABLE | stats count by php_version | sort -count

Set the period with duration (e.g. 7d, 12h) or with from and to (yyyyMMddHHmmss). To see the results of a single scan, pass its scan GUID in scan.

Registering targets in bulk - php2shell-add-target-batch

Register the url field of each input row as a target. probe=t also probes each new target as it is added.

json "{}" | eval url="https://192.0.2.10/" | php2shell-add-target-batch probe=t

If the URL is in another field, name it with field. The add_result field tells a new registration (added) from a duplicate (skipped) or a malformed URL (invalid).

Deleting targets in bulk - php2shell-delete-target-batch

Clean up unreachable targets. Their result history is deleted along with them.

php2shell-targets status=UNREACHABLE | php2shell-delete-target-batch

Scanning on the spot - php2shell-scan, php2shell-scan-batch

Scan without registering a target. The result is not stored; it comes back only as query output.

php2shell-scan url="https://192.0.2.10/" insecure=t

php2shell-targets status=ALIVE | php2shell-scan-batch insecure=t

insecure=t skips TLS verification for internal assets with self-signed certificates. Cancelling the query cuts the request in flight and stops at once.