PHP2Shell

PHP endpoint diagnostics

Less guesswork.
More evidence.

Inspect how your endpoint handles multipart requests. Compare the responses. Understand what they actually tell you.

Inspect an endpoint

Awaiting input

Only test endpoints you own or have permission to test. Sends multiple multipart POST requests; uploads may be processed by the target.

Ready when you are.

Enter a URL to compare a baseline response with a progress-field response. Results and request details appear here.

Warm-up
—
Baseline
—
Progress field
—
CHECKER RUNTIME PHP 8.5.11LOCAL UPLOAD PROGRESS ON
Read the signal

What this check can tell you.

The checker sends multipart requests from this server, then compares HTTP status codes and response fingerprints. Network restrictions can prevent it from reaching otherwise accessible sites.

  1. 01
    Same response

    No difference observed. An endpoint that ignores uploads may return the same response even on an affected PHP build.

  2. 02
    Different response

    A reason to investigate. Sessions, application logic and dynamic content can also change the response.

  3. 03
    No usable response

    Connection errors and rejected requests are inconclusive. Check reachability and server logs.

Act on evidence

Verify. Update. Recheck.

Confirm the target's PHP version and security status with its administrator. Apply the relevant vendor security update, then verify the deployed configuration and regression tests.

  1. ↗
    Start with the source

    Check official PHP release announcements and your distribution's security advisories for affected and fixed packages.

  2. ↗
    Review upload handling

    Check whether your application needs session.upload_progress.enabled before changing its configuration.

Download the complete source

One PHP file, including server logic and this interface. Password is submitted in the request body.