+- Hack Forums (https://hackforums.net)
+-- Forum: Tech (https://hackforums.net/forumdisplay.php?fid=444)
+--- Forum: Coding (https://hackforums.net/forumdisplay.php?fid=151)
+---- Forum: Web Development (https://hackforums.net/forumdisplay.php?fid=183)
+---- Thread: [PHP] silent PHP downloader (/showthread.php?tid=5911009)
silent PHP downloader - SkunT3llo - Nov 22, 2018
Hello can anyone tell me where can I buy silent PHP downloader.
I need for embedding it on my php site so anyone who visit the site it just download and execute for him
RE: silent PHP downloader - Squito - Nov 23, 2018
Such thing does not exist anymore.
RE: silent PHP downloader - Strayaa - Nov 23, 2018
Yeah so you can't actually do that in raw PHP... or any web language that I'm aware of
You could make something to call a download URL directly though and execute it from the desktop, just not in a web-sided language or markup
RE: silent PHP downloader - TCP - Nov 23, 2018
(Nov 22, 2018 09:44 PM)nsundov Wrote: Hello can anyone tell me where can I buy silent PHP downloader.
I need for embedding it on my php site so anyone who visit the site it just download and execute for him
You can't download without authorization, the browser is aware of all network requests
RE: silent PHP downloader - Disease - Nov 23, 2018
(Nov 22, 2018 09:44 PM)nsundov Wrote: Hello can anyone tell me where can I buy silent PHP downloader.
I need for embedding it on my php site so anyone who visit the site it just download and execute for him
The most unfortunate element here isn't that you're looking for a silent downloader, but the fact you have no clue what you're doing, nor understand the technologies you've deployed. If you did, you'd recognize that PHP does not interact with the client. As such, there's no way PHP could ever "silently" download anything. At best it could send a response header as a content type the browser doesn't parse, thus initiating a download request. But how that's handled is entirely up to the browser.
RE: silent PHP downloader - Nachfolger - Nov 23, 2018
(Nov 23, 2018 03:04 PM)Disease Wrote: The most unfortunate element here isn't that you're looking for a silent downloader, but the fact you have no clue what you're doing, nor understand the technologies you've deployed. If you did, you'd recognize that PHP does not interact with the client. As such, there's no way PHP could ever "silently" download anything. At best it could send a response header as a content type the browser doesn't parse, thus initiating a download request. But how that's handled is entirely up to the browser.It isn't run by the client, but that doesn't mean it does not interact with the client. I feel as if that's completely misleading.
RE: silent PHP downloader - Disease - Nov 23, 2018
(Nov 23, 2018 03:06 PM)Nachfolger Wrote: It isn't run by the client, but that doesn't mean it does not interact with the client. I feel as if that's completely misleading.
There is no interaction at all. The client communicates with the server (Apache, Nginx, LiteSpeed, etc.). If it's a PHP request, it hands that off to the PHP engine for interpretation. Headers and content body are generated and issued back to the server application for handoff to the client. That's it. PHP never has direct communication with the browser; it has zero influence on how the browser actually behaves, beyond what it can issue via headers/content.
RE: silent PHP downloader - SkunT3llo - Nov 23, 2018
(Nov 23, 2018 12:43 AM)Strayaa Wrote: Yeah so you can't actually do that in raw PHP... or any web language that I'm aware of
You could make something to call a download URL directly though and execute it from the desktop, just not in a web-sided language or markup
But is it possible to do it with javascript, because I saw some "FUD js downloader" so I thought maybe is possible to embed it instead php.
RE: silent PHP downloader - Abruptum - Nov 24, 2018
(Nov 23, 2018 07:56 PM)nsundov Wrote: But is it possible to do it with javascript, because I saw some "FUD js downloader" so I thought maybe is possible to embed it instead php.
Javascript gets executed on the Client side, php on the server.
So no its not possible unless you find a solution to exploit the http protocol.
RE: silent PHP downloader - Disease - Nov 24, 2018
(Nov 24, 2018 06:35 AM)Abruptum Wrote: Javascript gets executed on the Client side, php on the server.
So no its not possible unless you find a solution to exploit the http protocol.
Even an exploit of an HTTP protocol is futile. That just defines the standard for how traffic should be handled, and what responses look like. Ultimately it's on the browser to implement the standard.
For a silent download to work, an exploit in the browser would need to be found. Theoretically, it would be possible for an exploit in the browser's JavaScript engine to be found and leveraged, allowing a script to perform this. But then there's the issue of executing the file, even if it were possible to trick the browser into downloading to the disk without notifying the user.
In years past, these efforts were possible due to issues with the likes of ActiveX and Java. But those applications also had the ability to execute files on the hard disk. So while they were susceptible to the silent download, they also were able to do something with the download. And that's where the real danger lied.
RE: silent PHP downloader - Abruptum - Nov 24, 2018
(Nov 24, 2018 09:10 AM)Disease Wrote: Even an exploit of an HTTP protocol is futile. That just defines the standard for how traffic should be handled, and what responses look like. Ultimately it's on the browser to implement the standard.
For a silent download to work, an exploit in the browser would need to be found. Theoretically, it would be possible for an exploit in the browser's JavaScript engine to be found and leveraged, allowing a script to perform this. But then there's the issue of executing the file, even if it were possible to trick the browser into downloading to the disk without notifying the user.
In years past, these efforts were possible due to issues with the likes of ActiveX and Java. But those applications also had the ability to execute files on the hard disk. So while they were susceptible to the silent download, they also were able to do something with the download. And that's where the real danger lied.
Well maybe I wrote it a bit clumsy but I meant the exact thing you wrote :)
By exploiting the http protocol I mean he should invest how the browser implements HTTP protocol.
RE: silent PHP downloader - Disease - Nov 24, 2018
(Nov 24, 2018 09:18 AM)Abruptum Wrote: Well maybe I wrote it a bit clumsy but I meant the exact thing you wrote :)
By exploiting the http protocol I mean he should invest how the browser implements HTTP protocol.
Yeah no worries, I was just being nitpicky with terminology.
RE: silent PHP downloader - Elitas - Nov 24, 2018
Yeah, PHP is not the right language for this.
In order to download & exec it you'd need to find a vulnerability in an existing client side script. What you're looking for is an exploit kit capable of downloading and executing files without the client noticing. Such things do exist but are not publicly available.
Commonly such exploits existed in Java and Flash applications, although occasionally in the browser itself.
RE: silent PHP downloader - Skidsuper - Nov 24, 2018
I think your best bet is a javascript exploit php isn't the thing for this job. And they are rare. You can try looking at BEEF framework for concepts but they will work for educational purposes in test environments.