The NETTUTS.com site has posted a new PHP-related screencast that covers a simple script to scan over the contents of folders in PHP. To illustrate, they create an image gallery script that mirrors the filesystem structure.

Let's imagine that you want to build a page that will display snapshots of your latest work. [...] In such instances, the best solution is to make PHP scan your "portfolio" folder and dynamically create the code for you. If you want to update your page with a new snapshot, all that you need to do is drag the image, and its respective thumbnail, into the appropriate folders - and PHP will do the rest. Let's build it now!

The screencast comes complete with the entire source and a link to a demo to show the end result.

The Developer Tutorials blog has posted a new tutorial covering how to scan ports and checking a remote service's status with PHP.

Having access to the current status of public servers can empower your applications to make decisions and respond to problems automatically. Acknowledging a service is offline can also save endless support emails. In this tutorial, I'll show you how to keep track of your server status by scanning ports on your server with PHP.

They show how to check a remote instance (a socket open with a timeout) and how to run through a list of ports, looping from one to one-thousand and running an fsockopen on each. They make a sample script to show these two combined - a simple page that loops through the common protocols (HTTP, FTP, SSH, etc) and checks to see if the remote machine is running something on that port.

On the PHP Security Blog, there's three new posts that Stefan Esser has written up that demonstrate some of the more destructive uses of Javascript that he's found:

• JavaScript/HTML Portscanning and HTTP Auth
• Bruteforcing HTTP Auth in Firefox with JavaScript
• JavaScript Scanning and expose_php=On

While the first two are interesting, it's the last of these that most directly applies to PHP. He gives a simple "proof of concept" that checks to see if the embedded image is the correct "size" to be related to a webserver running PHP with the expose_php setting set to "on".

David Coallier has posted about his ideas for an Open Source, free PHP security scanner:

The idea of this project is quite simple, I was thinking that offering this service to anyone who requests it could be a very nice idea. Offering to run the scan is the only way I could ensure that people are not using this scanner against any website.

Basically, his idea is to offer this service free of charge, but still restrict it to avoid malicious use. It would involve validation via an md5 hash to ensure that the website has been authorized to run it. Check out the blog entry for more details on how the scan would be run.