27

How can I find the version of php that is running on a distinct server with distinct domain name? (like www.abc.com) It is not my server, no ftp access for making a php file with this code:

<?php
    echo PHP_VERSION;
?>
Tomasz
  • 3,726
  • 2
  • 25
  • 38
LostLord
  • 1,969
  • 9
  • 30
  • 31

10 Answers10

63

This works for me:

curl -I http://websitename.com

Which shows results like this or similar including the PHP version:

HTTP/1.1 200 OK
Date: Thu, 13 Feb 2014 03:40:38 GMT
Server: Apache
X-Powered-By: PHP/5.4.19
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Cache-Control: no-cache
Pragma: no-cache
Set-Cookie: 7b79f6f1623da03a40d003a755f75b3f=87280696a01afebb062b319cacd3a6a9; path=/
Content-Type: text/html; charset=utf-8

Note that if you receive this message:

HTTP/1.1 301 Moved Permanently

You may need to curl the www version of the website instead i.e.:

curl -I http://www.websitename.com
Neil Robertson
  • 3,165
  • 2
  • 25
  • 45
  • 2
    Hi @Vivek, I type this command into the command prompt on my Linux laptop. cURL can be enabled on your Windows machine too - see http://stackoverflow.com/q/2710748/1983389 for details – Neil Robertson Aug 09 '15 at 01:11
  • 1
    I just upgraded to php7 and I wanted to see the X-Powered-By in the browser and I get nothing, that entry is missing, do you have any ideas why? @NeilRobertson – santiago arizti Aug 04 '16 at 21:27
  • 4
    Hi @santiagoarizti, servers are often configured to hide this information for security purposes. – Neil Robertson Aug 07 '16 at 00:55
  • Neil is right, what would you do in this case? I use to hide those infos in apache/php and in the cms. I tried on one of the Wordpress sites I administer on one of the LAMP servers I administer, and the only useful thing I could read by both `curl -I` and redbot.org suggested by @neofutur was that: "Server: Apache". No apache, nor PHP's, nor even CMS's versions come out with proper hardening in place. – Marco Oct 12 '17 at 06:06
30

I use redbot, a great tool to see php version, but also many other useful infos like headers, encoding, keepalive and many more, try it on

http://redbot.org

I loveit !

I also upvote Neil answer : curl -I http://websitename.com

neofutur
  • 370
  • 5
  • 12
16

Sometimes, PHP will emit a X-Powered-By: response header which you can look at e.g. using Firebug.

If this setting (controlled by the ini setting expose_php) is turned off (it often is), there is no way to tell the PHP version used - and rightly so. What PHP version is running is none of the outside world's business, and it's good to obscure this from a security perspective.

Pekka
  • 418,526
  • 129
  • 929
  • 1,058
8

There is a surprisingly effective way that consists of using the easter eggs.

They differ from version to version.

Community
  • 1
  • 1
Jules G.M.
  • 3,200
  • 1
  • 16
  • 32
5

By chance: Default error pages often contain detailed information, e.g.

Apache/{Version} ({OS}) {Modules} PHP/{Version} {Modules} Server at {Domain}

Not so easy: Find out which versions of PHP applications run on the server and which version of PHP they require.

Another approach, only mentioned for the sake of completeness; please forget after reading: You could (but you won't!) detect the PHP version by trying known exploits.

rik
  • 8,341
  • 1
  • 22
  • 21
  • 1
    You could request a non-existing page to provoke 404. But you could have more luck with not so common errors ... try unsupported HTTP methods. – rik Jan 12 '11 at 18:50
2

I suggest you much easier and platform independent solution to the problem - wappalyzer for Google Chrome:

See here

nyagolova
  • 1,401
  • 2
  • 21
  • 37
0

Possibly use something like firefox's tamperdata and look at the header returned (if they have publishing enabled).

Brad Christie
  • 96,086
  • 15
  • 143
  • 191
  • a php forum asks this question for checking the ability of his users and he want us to find out his php version and when u get it he gives you some points... / so 100% there is a way for finding it out... / i test many versions and i figured out it's ver is 5.3.1 / but i am looking for the correct way for getting that...firebug and page soure not helped -> i searched 5.3.1 without any resault – LostLord Jan 12 '11 at 18:15
  • try using "site:website.com php version" in a google query and seing if any page on the site has it displayed. otherwise, people can (and do) go to the trouble of hiding their engine (and more specifically version) due to how easy it can be when version "x.x.x" has a new security threat, you could search for every website running that version and exploit it. – Brad Christie Jan 12 '11 at 18:23
  • i do your way (mean googled it) and i figure out the NMAP is the answer(from that forum)... an open source Program... – LostLord Jan 12 '11 at 18:46
0

There is a possibility to find the PHP version of other domain by checking "X-Powered-By" response header in the browser through developer tools as other already mentioned it. If it is not exposed through the php.ini configuration there is no way you can get it unless you have access to the server.

Kalyan Chakravarthi V
  • 141
  • 2
  • 10
-1

You can’t. One reason is that not every web site uses PHP. And another reason is: Even if there are some signs that PHP might be used (e.g. .php file name extension, some “PHPSESSID” parameter, X-Powered-By header field containing “PHP”, etc.) those information might be spoofed to let you think PHP is used.

Gumbo
  • 594,236
  • 102
  • 740
  • 814
-7

THE ANSWER IS : NMAP PROGRAM

THANKS FOR YOUR ATTENTIONS ...

another way is getting HTTP Headers by this site (http://web-sniffer.net/) or firefox add-on for getting HTTP Headers...

Best Regards

LostLord
  • 1,969
  • 9
  • 30
  • 31