GVPH PHP SCANNER 1.8.0
Granville Vance Public Health
Download: https://gvph.org/download/phpscanner/

WEBSITE CHECKS AND ONE-TIME SETUP

Public websites can be checked directly on the GVPH page without a download.
Internal websites need this local scanner. The page also offers a single Windows
setup file that downloads and verifies the package, prepares it in your profile,
and registers Open local scanner for future visits. No manual ZIP extraction is
needed with that option. Run setup again to install a newer release.

Enter an explicit HTTP/HTTPS website URL to review that page. Results include
Website security observations: cookie flags, browser protection headers, HTTP
resources and password-form concerns. These are passive observations, not proof
of an exploit. Login-only issues, injection, authorization, malware and full TLS
configuration are not tested. Use the public-address option for Internet sites.
Internal scan results stay on your computer. The hosted public checker processes
the selected URL on GVPH's server; its page explains coverage and privacy.

WINDOWS — NO INSTALLATION REQUIRED

1. Extract the entire ZIP into a folder on your computer.
2. Open Start-PHP-Network-Audit.cmd. Keep its console window open.
3. The GVPH scanner opens in your browser. Choose a device, subnet or target list.
4. Select Review scan, review the exact scope, confirm your authorization, and
   select Start scan. Nothing is scanned automatically.
5. Review the Results tab. Download CSV/JSON or open the full HTML report.
6. Select Exit scanner when finished, or close the console window.

Starting device: 192.168.1.1. You can change it on every run. The subnet shortcut
fills 192.168.1.0/24 (.1 to .254); verify your actual subnet mask before scanning.
Load a target list accepts plain text with devices, CIDRs or application URLs. The scanner checks up to 4 ports per target in parallel and shows live findings. Standard uses 13 common ports, including 4443, and a 3-second timeout. Gentle reduces traffic.

THOROUGH CHECKS (enabled in the browser)
Retries transient TCP/HTTP failures once with up to twice the deadline (maximum
15 seconds), compares HEAD headers, and tries /index.html, /index.php and
/login.php on root targets. Decodes bounded gzip/deflate/Brotli page samples and
recognizes HTML without Content-Type. A failed DNS query also tries the operating
system resolver. Select the optional 30 management ports preset to widen the
reviewed port list; vendor-specific ports can still be entered.
At most 12 HTTP requests per endpoint, including retries and redirects. Each
result includes expandable Check history. CSV has a compact history; JSON has
all attempts and coverage. TLS validation is never silently disabled.
Thorough checks take longer. For a quick first pass, uncheck Thorough checks.
Authentication, hidden versions, IPv6 and isolated networks still need separate
inventory. The tool does not guess PHP versions from product names.

The Windows x64 runtime is included and its original OpenJS signature is intact.
Windows 10/11 x64 or a compatible Windows Server desktop is required. Run under
your organization's normal software policy; contact IT if it is blocked.
No administrator rights are needed for the scanner. Keep the extracted runtime
and ui folders beside the launcher. Do not run it from inside the ZIP viewer.

Reports are saved under your user profile:
  %LOCALAPPDATA%\GVPH\PHP Scanner\reports
Use Open saved reports to find them. Reports persist after closing the tool;
remove them according to your organization's information-retention requirements.

PRIVACY AND SCOPE
The app listens only on this computer's loopback address. Results are not sent
to GVPH, and no cloud account or scan-data upload is used. It sends ordinary
unauthenticated web requests to the scope you confirm. Devices may log them or
create anonymous sessions. Treat exported reports as internal infrastructure data.

This is IPv4 inventory and version triage, not an exploit/compromise test. Hidden
PHP, missing headers, other ports, virtual hosts, IPv6, isolated VLANs and bundled
runtimes may be missed. Unreachable devices are not cleared. Vendor backports
must be checked against both CVEs. Rules are dated October 23, 2026; review the
current advisory before making remediation decisions.

UPDATE HELP
The Update guide tab and UPDATE-GUIDE.txt explain next steps. A guided updater
is included for ordinary Debian/Ubuntu servers. Appliances/NAS/firewalls need
vendor firmware updates; do not replace their embedded PHP generically.

Advanced command-line use: Start-Command-Line.cmd or runtime\node.exe audit.cjs --help

The runtime's licenses are in runtime\LICENSE. Its verified download provenance
is in runtime\provenance.json. SHA256SUMS.txt records package-file checksums.

VERSION 1.3 DEVICE DETAILS
The default now follows up to 3 redirects on the same hostname and selected
ports; explicit URLs stay on their own port. Other hosts, query strings, device
action paths and HTTPS downgrades are skipped. Disable this in scan settings.
Product names identify page branding, not firmware or PHP versions. Linear eMerge
and HPE Instant On pages receive model/firmware follow-up guidance. Server headers,
application generator and authentication scheme are shown when advertised.
The default results include open-port/TLS failures; use TLS certificate blocks
to find certificate-related gaps. TLS validation remains enabled by default.
Not disclosed = PHP indicators with no exact version. Not detected = no PHP
indicators in a successful page. Not assessed = unreadable/error/redirect page.
A hidden PHP version requires authenticated host inventory or vendor confirmation.

VENDOR UPDATE LINKS
Results now show Official update sources beside recognized devices and PHP
findings. Links open vendor downloads, support or update instructions; they do
not install anything. Match your model and firmware and confirm both CVEs are
fixed. Unidentified platforms show PHP and NCSC advisory links with guidance.
These links are included in the saved HTML, CSV and JSON reports.

DNS AND CONNECTION DETAILS (1.8.0)
Website reports show DNS answers, returned aliases, connection failures and
qualified proxy clues. These do not reveal a hidden PHP version.
Local Thorough checks can retry up to two reverse-DNS hostnames for incomplete
internal IP responses. Forward DNS must point exclusively to the original IP.
All requests stay pinned to that device and the reviewed ports, within the
existing twelve-request limit. DNS checks share at most three seconds per IP.
Expand DNS and connection details in your results to see what happened.
