Php or asp availability lookup

The problem is the only way to get information about php installation is using php and running a script, for example, the most basic test script:

<?php
echo "hello world";
?>

or to print php info

<?php
phpinfo();
?>

but you can run a script on their server remotely so unless there is another way of connecting to their server and extracting information about the installed software the only option i can think of is to get the user to download a small script and get them to run it on their server. The best example of which would be:

---------------------------------------------
<?php
echo "Your server has php support";
echo "<!--";
?>

Your server does not have php support

<?php
echo "-->";
?>
---------------------------------------------

If php is installed they will see "Your server has php support" (and not the html message because it will have been commented out). The downside is this method is a little inconvienient and doesnt give you much information but as i said unless there is an alternative way of extracting such information from their server that im unaware of there may be little choice.

Diablo

>> but you can run a script on their server remotely

sorry, should have been can't run a script on their server remotely

with regards to ASP i would imagine the same rules apply and you could use the same method to test.

You can check the server banner, like php.net's server banner is...

Server: Apache/1.3.26 (Unix) mod_gzip/1.3.26.1a PHP/4.3.3-dev

Its a HTTP header the server sends out after a request, Do this...

<?php

$php = FALSE;
$asp = FALSE;

$header = '';
$url = 'http://www.php.net/';
$page = @ fopen($url, 'r');
$headers = @ stream_get_meta_data($page);
@ fclose($page);

foreach ($headers['wrapper_data'] as $header)
{
    if (strstr($header, 'Server:')) {
        if (stristr($header, 'php')) {
            $php = TRUE;
        }
        if (stristr($header, 'iis')) {
            $asp = TRUE;
        }
    } else if (strstr($header, 'X-Powered-By:')) {
        if (stristr($header, 'php')) {
            $php = TRUE;
        }
        if (stristr($header, 'iis')) {
            $asp = TRUE;
        }
    }
}

if ($php)
    echo $url . ' has PHP';

if ($asp)
    echo $url . ' has ASP';

?>

that will get a satart on detecting if a page has ASP or PHP, to get the version you will need to just get the substring from the 'Server' or 'X-Powered-By' headers. Do note not all servers will output a header but most do. This is the only way I can see in remotelt checking a servers capabilites. If you want you can just echo the entire server banner to the user so they can see additonal modules and languages used by the server. Good luck!


-Nick

Another thing is to access invlaid URL like www.somesite.com/pagethatdoesnotexist.html and retreive the stream_get_meta_data() as in my code above, then you can see if it was redirected and check the 404 page's extention if its PHP or ASP, that wont be as good as above where you can see the version to but it should be used alongside the above code in the event the server banner is not there.

oh, if you pass user input to shell commands, don't forget to use escapeshellargs ($userInput)!

Thank you all for the feedback and ideas :)

I've been sitting here debating on whether to go with CrYpTiC_MauleR's or blackelvis's solution.  I will go with blackelvis here, but CrYpTiC_MauleR - I appreciate your help as well and will keep an eye out for you in the future.

Chris