Phpinfo.php~

Key Takeaways

• Critical Security Risk: The presence of phpinfo.php~ is a major information disclosure vulnerability, often categorized under CWE-200.
• Editor-Generated Backups: The tilde (~) suffix is typically created by text editors like Vim or Gedit, indicating a leftover temporary or backup file.
• Information Goldmine: These files reveal sensitive data including PHP versions, loaded modules, environment variables, absolute file paths, and server configurations.
• Attack Escalation: Information gathered from these files is frequently used by attackers to plan sophisticated Remote Code Execution (RCE) attacks.
• Immediate Remediation: Delete all phpinfo() files from production environments and implement strict directory access controls.
• Prevention Strategy: Use CI/CD pipelines to scan for temporary files and configure web servers (Apache/Nginx) to deny access to hidden or backup files.

Introduction

In the realm of web server administration and cybersecurity, few things are as deceptively simple yet profoundly dangerous as a stray configuration file. One specific filename that frequently appears in vulnerability scans and penetration testing reports is phpinfo.php~. To a casual observer, it looks like a mere typo or a temporary file. To a security professional, it is a flashing red light indicating a significant breakdown in server hardening and deployment hygiene.

The phpinfo() function in PHP is a diagnostic tool designed to provide developers with a comprehensive overview of the current PHP environment. While invaluable during the local development phase, its presence on a production server is a critical error. The addition of the tilde (~) character transforms a known risk into a specific type of vulnerability: the exposure of editor-generated backup files. This happens when a developer uses a command-line editor like Vim to modify a phpinfo.php file, and the editor creates a swap or backup file that remains accessible via the web server.

Current cybersecurity trends show that automated bots and reconnaissance scripts are constantly scanning the internet for these exact patterns. A single exposed phpinfo.php~ file can provide an attacker with 90% of the intelligence required to exploit a server, effectively bypassing the "reconnaissance" phase of a cyberattack. This article provides a deep dive into why this happens, what data is at risk, and how to fortify your infrastructure against such leaks.

Deep Analysis

The Mechanics of the Tilde (~) Suffix

The tilde suffix is not a feature of PHP itself, but rather a side effect of how various Unix-based text editors handle file saving. When a developer opens a file like phpinfo.php in an editor such as Vim, Emacs, or Gedit, the editor often creates a temporary or backup version of the file to prevent data loss during a crash.

For instance, Vim often creates swap files (e.g., .phpinfo.php.swp), but many automated backup routines or specific editor configurations will append a ~ to the original filename (e.g., phpinfo.php~). If the web server's document root is set to the directory where these edits occurred, and there are no rules in place to prevent the serving of non-standard file extensions, the web server will treat phpinfo.php~ as a static file. Because it is not a .php file, the server may not execute it as code, but instead serves the raw text content directly to the browser—which, in this case, is the exact diagnostic output the developer intended to hide.

The Anatomy of Information Disclosure

When an attacker accesses phpinfo.php~, they are not just seeing a list of settings; they are receiving a blueprint of the server's internal architecture. The output of phpinfo() is categorized into several high-value sections:

1. Core Environment and OS Details

The output identifies the exact operating system (e.g., Linux kernel version), the server software (e.g., Apache 2.4.41 or Nginx 1.18.0), and the PHP version (e.g., PHP 7.4.33). Knowing the exact version allows an attacker to search the CVE (Common Vulnerabilities and Exposures) database for known exploits targeting those specific versions. For example, if the version is outdated, they can immediately deploy a known exploit for a buffer overflow or remote code execution.

2. Loaded Modules and Extensions

The file lists every enabled PHP extension. This is critical for an attacker to understand the "capabilities" of the server.

• curl: Indicates the ability to make outbound requests (useful for SSRF attacks).
• mysqli / PDO: Confirms database connectivity capabilities.
• imagick / gd: Suggests potential for image-based exploits.
• shell_exec / system: If these functions are not listed in the disable_functions directive, the attacker knows they can execute OS-level commands.

3. Configuration Directives (The Security Goldmine)

This is perhaps the most dangerous section. It reveals the security posture of the PHP configuration. Specific directives include:

• allow_url_fopen and allow_url_include: If these are set to On, the server is highly vulnerable to Remote File Inclusion (RFI).
• display_errors: If On, the attacker can use error messages to perform "Error-Based SQL Injection" or path discovery.
• open_basedir: Reveals the directory restrictions placed on PHP. If this is not set, the attacker knows they can traverse the entire file system.
• session.save_path: Provides the exact location where session files are stored, which can lead to Session Hijacking if the attacker gains limited file access.

4. Environment Variables

In modern cloud environments (AWS, Azure, Docker), sensitive information is often passed to the application via environment variables. A phpinfo() dump will frequently display these variables in plain text. This can include:

• AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY
• DATABASE_PASSWORD
• API_KEYS for third-party services (Stripe, SendGrid, etc.)
• DEBUG_MODE settings

The Attack Lifecycle: From Disclosure to RCE

An attacker does not simply find a phpinfo.php~ file and stop there. They use it as a stepping stone. The process typically follows this pattern:

1. Reconnaissance: The attacker finds phpinfo.php~ using a tool like dirb or ffuf.
2. Intelligence Gathering: They parse the file to find the PHP version, the absolute path of the web root (e.g., /var/www/html/public/), and the list of enabled modules.
3. Vulnerability Mapping: They check if disable_functions is empty. If they see exec, passthru, or shell_exec are not disabled, they know they have a path to the OS.
4. Exploitation: Using the absolute path discovered, they craft a payload (e.g., a file upload exploit) that targets the specific directory structure revealed by the phpinfo output.

Comparison / Alternatives

Understanding how phpinfo.php~ differs from other diagnostic methods is essential for proper risk management.

Common Mistakes / Misconceptions