Server Security Audit

PHP Version Information

PHP Version: 8.4.13

OK: PHP version is current

Open Base Dir Protection

PROTECTED: open_basedir is configured

/home/t91/:/tmp/:/var/tmp/:/opt/alt/php84/usr/share/pear/:/dev/urandom:/usr/local/php84/lib/:/usr/local/php84/lib/:/usr/local/lib/php/:/var/www/omnicoder

PHP file access is restricted to the directories listed above.

Dangerous Functions Analysis

High Risk

Function	Status
exec()	DISABLED
shell_exec()	DISABLED
system()	DISABLED
passthru()	DISABLED
popen()	DISABLED
proc_open()	DISABLED
pcntl_exec()	DISABLED

Medium Risk

Function	Status
eval()	DISABLED
assert()	ENABLED
create_function()	DISABLED
include()	DISABLED
require()	DISABLED

File Operations

Function	Status
file_get_contents()	ENABLED
file_put_contents()	ENABLED
fopen()	ENABLED
readfile()	ENABLED
unlink()	ENABLED

Information Disclosure

Function	Status
phpinfo()	ENABLED
posix_getpwuid()	DISABLED
getenv()	ENABLED
get_current_user()	ENABLED

Disabled Functions List

exec,system,passthru,shell_exec,proc_close,proc_open,dl,popen,show_source,posix_kill,posix_mkfifo,posix_getpwuid,posix_setpgid,posix_setsid,posix_setuid,posix_setgid,posix_seteuid,posix_setegid,posix_uname

PHP Security Settings

Setting	Current Value	Recommended	Status
display_errors	Empty	0	INSECURE
expose_php	Empty	Off	INSECURE
allow_url_fopen	1	Off	INSECURE
allow_url_include	Empty	Off	INSECURE
register_globals	Not Set	Off	INSECURE
magic_quotes_gpc	Not Set	Off	INSECURE
session.cookie_httponly	Empty	1	INSECURE
session.cookie_secure	0	1	INSECURE
session.use_strict_mode	0	1	INSECURE

File System Access Tests

Common System File Access Tests

Testing if PHP can read sensitive system files outside the user directory:

✗ /etc/passwd - File does not exist or access denied

✗ /etc/shadow - File does not exist or access denied

✗ /etc/hosts - File does not exist or access denied

✗ /etc/apache2/apache2.conf - File does not exist or access denied

✗ /etc/nginx/nginx.conf - File does not exist or access denied

✗ /etc/my.cnf - File does not exist or access denied

✗ /etc/mysql/my.cnf - File does not exist or access denied

✗ /var/log/apache2/error.log - File does not exist or access denied

✗ /var/log/nginx/error.log - File does not exist or access denied

✗ /proc/version - File does not exist or access denied

✗ /root/.bash_history - File does not exist or access denied

✗ /home - File does not exist or access denied

Write Access Tests

Testing if PHP can write to directories outside the user directory:

✓ /tmp - Directory is writable

✓ /var/tmp - Directory is writable

✗ /var/www - Directory is not writable

✗ /etc - Directory is not writable

✗ /root - Directory is not writable

Directory Listing Tests - /tmp and /var/tmp

Attempting to list files in temporary directories:

/tmp

✓ Directory is accessible and readable

Files found: 28

[FILE] (84 bytes) [--] adminer.invalid
[FILE] (84 bytes) [--] adminer.invalid-1997bd376773a298a4c810581bfe444a
[FILE] (122 bytes) [R-] enc_wallet_cache.json
[FILE] (27 bytes) [R-] rate_48f30b8e829aef224a9aa7c7b9c8ea55
[FILE] (0 bytes) [--] sess_0254961a5ddf29d03fd6a9d89f4353cd
[FILE] (0 bytes) [--] sess_17b6e20abb71387a8e5161b45715cf0f
[FILE] (0 bytes) [--] sess_22fa905bb9f58f98b6e8b547720ca8ec
[FILE] (0 bytes) [--] sess_2458c9782ac250b1ea618b6cf86d83e6
[FILE] (0 bytes) [--] sess_472596c22d108e59effdd81866fe3281
[FILE] (0 bytes) [--] sess_4a1393f704c9b69aed1bd5a219926c84
[FILE] (0 bytes) [--] sess_513d2f33ddf035a2caf555376c4c55c3
[FILE] (0 bytes) [--] sess_5751484caaa6fc554a47a574923cd27b
[FILE] (0 bytes) [--] sess_7d2f7b9cd0ea9510634c8ab7b363b7ae
[FILE] (0 bytes) [--] sess_8fe3424230d367ba1da9aeab39f78c19
[FILE] (0 bytes) [--] sess_930fa0164ff85dc889398ae844d36f71
[FILE] (0 bytes) [--] sess_971696b7bba9b4d8cb1111350c55888b
[FILE] (0 bytes) [--] sess_99c6a7748ef358f10ff57fb655be3631
[FILE] (0 bytes) [--] sess_a4a7cd332c462d62a2411292e0bf9187
[FILE] (0 bytes) [--] sess_aec1db719fa3f0399aa2c6431fbc2564
[FILE] (0 bytes) [--] sess_b38ca823a153cafc9e97717ec8bccd3f
[FILE] (0 bytes) [--] sess_c9bf9c6a0c84ccc9655e9ebe5dad3b74
[FILE] (0 bytes) [--] sess_cb599b6b90ea6812a24e96cabd0112a2
[FILE] (0 bytes) [--] sess_cb5ae56c7dc892ba40a1e49565caf11b
[FILE] (0 bytes) [--] sess_ce5f501c5c3bafbef6b928b61f35dfeb
[FILE] (0 bytes) [--] sess_ea18bae706a4563e64bcdcc73af7e466
[FILE] (0 bytes) [--] sess_f14adbae1605b0b329802ecf008366a4

Attempting to Read Files in /tmp

✗ Cannot read: adminer.invalid (Permission denied)

✗ Cannot read: adminer.invalid-1997bd376773a298a4c810581bfe444a (Permission denied)

✓ Successfully read: enc_wallet_cache.json (122 bytes read)

Preview: {"totalTransactions":1,"totalIn":0,"totalOut":0,"balance":0,"receiverWallet":"0x179fdae0631f14225aef...

✓ Successfully read: rate_48f30b8e829aef224a9aa7c7b9c8ea55 (27 bytes read)

Preview: {"ts":1773342878,"count":1}

✗ Cannot read: sess_0254961a5ddf29d03fd6a9d89f4353cd (Permission denied)

✗ Cannot read: sess_17b6e20abb71387a8e5161b45715cf0f (Permission denied)

✗ Cannot read: sess_22fa905bb9f58f98b6e8b547720ca8ec (Permission denied)

✗ Cannot read: sess_2458c9782ac250b1ea618b6cf86d83e6 (Permission denied)

✗ Cannot read: sess_472596c22d108e59effdd81866fe3281 (Permission denied)

✗ Cannot read: sess_4a1393f704c9b69aed1bd5a219926c84 (Permission denied)

Summary: Successfully read 2 out of 10 tested files

/var/tmp

✓ Directory is accessible and readable

Files found: 2

Attempting to Read Files in /var/tmp

Current Directory Information

Current Working Directory: /home/t91/domains/surround-flash-9d7a403c-91.app.omni-coder.com/public_html
Document Root: /home/t91/domains/surround-flash-9d7a403c-91.app.omni-coder.com/public_html
Script Filename: /home/t91/domains/surround-flash-9d7a403c-91.app.omni-coder.com/public_html/index.php
Current User: t91
User ID: 1019
Group ID: 1020

Server Information

Parameter	Value
Server Software	Apache/2
Server Name	surround-flash-9d7a403c-91.app.omni-coder.com
Server Protocol	HTTP/1.0
PHP SAPI	fpm-fcgi
Operating System	Linux
Server Admin	webmaster@surround-flash-9d7a403c-91.app.omni-coder.com
Document Root	/home/t91/domains/surround-flash-9d7a403c-91.app.omni-coder.com/public_html

Loaded PHP Extensions

• Core

• FFI

• PDO

• Phar

• Reflection

• SPL

• SimpleXML

• bcmath

• calendar

• cgi-fcgi

• ctype

• curl

• date

• dom

• exif

• fileinfo

• filter

• ftp

• gd

• gettext

• hash

• iconv

• intl

• json

• libxml

• mbstring

• mysqli

• mysqlnd

• openssl

• pcre

• pdo_mysql

• pdo_sqlite

• posix

• random

• session

• shmop

• soap

• sockets

• sodium

• sqlite3

• standard

• sysvmsg

• sysvsem

• sysvshm

• tokenizer

• xml

• xmlreader

• xmlwriter

• xsl

• zip

• zlib

Security Summary

No major vulnerabilities detected

The server appears to have reasonable security configurations in place.