# PHP2Shell Hunt Graph

- **Graph:** https://forefy.com/graphs/d0b1409a-dd74-4e63-9ac9-e0530490bd42
- **Graph (JSON):** https://forefy.com/api/di3/public/graphs/d0b1409a-dd74-4e63-9ac9-e0530490bd42

## Registry items

- **nuclei-suggest** (skill) - https://forefy.com/skills/87b50395-f6aa-4dde-8a00-560de2f59c87: Browse the nuclei-templates library, recommend a scoped template set for a given stack, target, or CVE, then run it against an authorized target and report findings.
- **error-probe** (goal) - https://forefy.com/goals/aec69ab0-ae6f-41e6-8b64-704e5a3866fa: Against a live application's public surface (given its domains or endpoints), flush out error-handling defects observable from the outside - leaked internals, wrong status semantics, server faults on ...
- **webapp-probe** (skill) - https://forefy.com/skills/de6bd2de-73f9-4f1c-87c2-d637e2e827ec: Probe a web app for what it exposes or leaks - passively from captured traffic and actively against the target. Use to assess a web app's exposure or review Burp/ZAP history.

## Diagram

- Request user for target scope (APEX domains) -> github.com/projectdiscovery/subfinder: subdomain enumeration
- github.com/projectdiscovery/subfinder -> iterate PASSIVE information gathering: for each subdomain
- iterate PASSIVE information gathering -> nuclei-suggest: php indications
- iterate PASSIVE information gathering -> error-probe: php errors
- iterate PASSIVE information gathering -> webapp-probe: php indications
- nuclei-suggest -> github.com/projectdiscovery/nuclei-templates: use php-detect.yaml to detect php apps passively
- nuclei-suggest -> Human
- error-probe -> Human
- webapp-probe -> Human: Inform human