credkellar/php-vuln-re repository overview

🛡️ PHP-Vuln-RE — Created by Darion Kellar

A static, synthetic, defensive reverse-engineering lab for PHP vulnerabilities. The PHP samples are source strings stored as data and analysed as text — PHP is never executed, no live site is fetched, and no exploit is run.

⁠🔍 What it analyses — 14 synthetic samples

SQL injection (CWE-89) · Reflected + stored XSS (79) · OS command injection (78) · LFI / path traversal (22) · RFI (98) · Arbitrary file upload (434) · PHP object injection via unserialize() (502) · Code injection — eval / create_function / preg_replace /e (94) · SSRF (918) · Type juggling / loose == auth bypass (697) · Weak crypto + randomness — md5 / mt_rand (327/338) · XXE (611) · extract()/parse_str overwrite + missing CSRF token (352)

⁠🧰 Reverse-engineering tools

• Source → sink taint mapping: $_GET / $_POST / $_REQUEST / $_COOKIE / $_FILES / php://input to each dangerous sink, with sanitizer detection that lowers the deterministic 0–100 risk score
• Obfuscation counter: eval(base64_decode(...)), gzinflate, str_rot13, hex escapes, $$ variable-variables, high-entropy blobs — layers counted, never decoded-and-run
• Framework fingerprinting: Laravel · WordPress · Symfony · CodeIgniter · plain PHP
• Encoded-file detection: ionCube / Zend Guard / SourceGuardian header markers, static only
• Hardening: a publisher-side fix for every flaw (PDO prepared statements, htmlspecialchars(ENT_QUOTES), password_hash, random_bytes, unserialize with allowed_classes=false, and more)

⁠📦 Sandbox-API + 🍯 Honeypot

Static Sandbox-API chamber triage (never executes, any_executed=False, zero network) and honeypot trap-log analysis (12 synthetic attempts classified, top threat scored, no live listener — listener_open=False). All 4 Google Flows run for both brains (FlowX 13 subtasks, Studio starters, Flow Filmmaking plan-only, DataX Flow engine).

⁠🧠 Brains + gates

Gemini Carbon 4 Extended Thinking decides first, Muse (muse-spark-1.1 / muse-wonder-1.0) advises and can never override a HOLD. 14 HOLD gates including execute PHP sample, exploit a live site, upload a web shell, live auth bypass, live unserialize payloads, live video generation, sandbox network access, and opening a live honeypot listener. From-scratch kNN + centroid ML classifies the vuln family — 1.0 on the synthetic held-out set (train 150 / test 50).

⁠▶️ Run it

docker pull credkellar/php-vuln-re:latest
docker run --rm credkellar/php-vuln-re
python main.py          # full lab report
python main.py check    # CHECKS 84/84
python main.py sample sqli-01

Verified locally: pytest 50 passed · CHECKS 84/84 · --hold-demo exit 2. Zero runtime dependencies, one main.py, Python stdlib only.

⚠️ Honest limits: regex/static only (no AST, no cross-file dataflow), ML is trained on synthetic prototypes only, brain seats are offline / names-only with no live API calls.