PHPScan
PHPScan is a symbolic execution inspired PHP application scanner for code-path discovery. Using a custom extension, it hooks directly into the Zend Engine to track variables and opcodes (assignments, comparisons, etc). Using this information it tries to satisfy as many branch conditions as possible. The goal is to discover valid input (in terms of $_GET, $_POST and $_COOKIE variables and values) that results in reaching a specfic location within the application or to maximize code coverage.
Author Bart van Arnhem ([email protected]).
Disclaimer
PHPScan is very much a work-in-progress and is not yet in a state to be used on larger real-world applications. If you have any suggestions or feedback please let me know.
Usage
$ python phpscan.py --help
usage: phpscan.py [-h] [-v {0,1,2}] entrypoint
positional arguments:
entrypoint the PHP application entrypoint
optional arguments:
-h, --help show this help message and exit
-v {0,1,2}, --verbose {0,1,2}
increase verbosity (0 = results only, 1 = show
progress, 2 = debug
example examples/example3.php
<?php
if (isset($_GET['page'], $_GET['num']))
{
if ($_GET['page'] === 'home')
{
phpscan_flag('reached_home');
}
if (intval($_GET['num'] > 10))
{
phpscan_flag('reached_greater_than');
}
}
?>
$ python phpscan.py examples/example3.php
Scanning of examples/example3.php finished...
- Needed 5 runs
- Took 0.234709 seconds
Successfully reached "reached_home" using input:
_POST
_GET
num
value: 11 (integer)
page
value: home (string)
_COOKIE
_REQUEST
Successfully reached "reached_greater_than" using input:
_POST
_GET
num
value: 11 (integer)
page
value: home (string)
_COOKIE
_REQUEST
Installation
Install dependencies
PHP7
$ sudo apt-get install php7.1-cli
Runkit7
Build the unofficial PHP7 runkit fork according to the instructions at https://github.com/TysonAndre/runkit7#building-and-installing-runkit7-in-unix
To enable Runkit7 and allow overriding of internal PHP functions add the following lines to your php.ini configuration file:
extension=runkit.so
runkit.internal_override=On
Z3
Build Z3 and the Z3 Python bindings as per instructions on https://github.com/Z3Prover/z3. Make sure the <z3-builddir>/python path is added to your PYTHONPATH enivoronment variable:
$ export PYTHONPATH="<z3-builddir>/python:${PYTHONPATH}"
Download latest PHPScan
$ git clone https://github.com/bartvanarnhem/phpscan.git
Build the Zend Extension
$ cd phpscan/zend_extension
$ phpize
$ ./configure
$ make
$ sudo make install
To enable the PHPScan Zend Extension add the following lines to your php.ini configuration file:
extension=phpscan.so