{ "ml": { "v": "7", "eng": "2.0.1-rc.1", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.000040233135, "rte": "az", "prob": 0.000040233135 }, { "cls": 0, "raw": 0.000017881393, "rte": "az/scripts", "prob": 0.000017881393 }, { "cls": 0, "raw": 0.41759333, "rte": "az/php", "prob": 0.41759333 } ], "prob": 0.000040233135, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.00004023313522338867, "type": "php" } ], "version": "v18.18", "analyzed_at": "2026-06-15T06:11:44Z" }, "path": "array_format.php", "raw": { "v": "7", "tv": "061e3", "files": [ { "id": 0, "ctx": [ { "a": 7, "b": "w{503BzkVhaAh1kx(mK3uTW$}vr\u003cmI", "l": 3 }, { "a": 32, "b": "DJ", "l": 4 }, { "a": 34, "b": "arR^Hz^)6{Byxiic[dj", "l": 5, "n": [ { "c": 3, "d": "Output buffer capture pattern", "i": "micro-behaviors/process/io/buffer::output-buffer-capture", "o": 38, "z": 8 } ] }, { "a": 50, "b": "arR^HAa\u003ci8zF0/neIOXo", "l": 6, "n": [ { "c": 3, "d": "Dumps PHP configuration via phpinfo()", "i": "objectives/discovery/system/fingerprint/info::phpinfo-call", "o": 54, "z": 7 } ] }, { "a": 67, "b": "arR^HbYEDujS[Y:wOkv\u003cwPhD]v}v4", "l": 7 }, { "a": 91, "b": "arR^Hvrcx%C{\u003e3+um)Y\u0026vSb!5j$53kdlGm)z!abSe?ea\u003ezf46Q", "l": 8, "n": [ { "c": 3, "d": "Generates HTML tags", "i": "micro-behaviors/data/format/html::html-generator-tags", "o": 101, "z": 5 } ] }, { "a": 132, "b": "arR^HarR^HarS3RjzlGlp!jz9oLF0FzGxwKfk9a8e?ea\u003ezf46Q", "l": 9 }, { "a": 173, "b": "arR^HarR^HarS3RjzlDklVl\u003cOx\u003eINevruj4zAGN=f*l*fec", "l": 10 }, { "a": 750, "b": "arR^HarR^HarS3Rjtg!%j%IBa", "l": 27 }, { "a": 771, "b": "arR^HarR^HarS3RjySsNffQQdec", "l": 28 }, { "a": 793, "b": "arR^HarR^HarS3RlVl{?A+Pf1Br-dZec", "l": 29, "n": [ { "c": 2, "d": "Copyright notice", "i": "metadata/package/license::copyright-word", "o": 805, "z": 9 } ] }, { "a": 819, "b": "arR^Hvrcx%C{\u003e3=f^!H", "l": 30 }, { "a": 835, "b": "arR^HarR^HarS3Vec", "l": 31 }, { "a": 1374, "b": "arR^HarR^HarS3OcOb", "l": 50 }, { "a": 1389, "b": "arR^HarR^HarS3OlVl{?A+Pf1BseH*", "l": 51 }, { "a": 1414, "b": "arR^Hz^)6^wPRo?y?m3)c[cPb", "l": 52, "n": [ { "c": 3, "d": "Gets and cleans output buffer", "i": "micro-behaviors/process/io/buffer::ob-get-clean", "o": 1418, "z": 12 } ] }, { "a": 1435, "b": "", "l": 53 }, { "a": 1436, "b": "arR^HbY^KbBzkVhB09Q*wQ5fgz!9AccP(5$j%})7B98CpA9)Y}xlbEDAa{\u003cCcP(5$k0i}2k0i{$j%}^di@", "l": 54 } ], "mol": "O(Dy)H(Po)", "sha": "dce4b68fb07fb835fd7a21b135e05ddd95c8661c9c050005cac949271df40e59", "fact": { "id": "php", "imp": [ [ "", "ob_start" ], [ "", "phpinfo" ], [ "", "preg_replace" ], [ "", "ob_get_clean" ], [ "", "explode" ], [ "", "strip_tags" ], [ "", "substr" ], [ "", "strpos" ], [ "", "preg_match_all" ], [ "", "isset" ], [ "", "array_slice" ], [ "", "phpinfo_array" ] ], "met": { "ast": { "op.eq": 1.0, "op.lor": 1.0, "op.sub": 1.0, "op.lnot": 1.0, "max_depth": 16.0, "op.concat": 11.0, "bind_count": 5.0, "call_count": 12.0, "node_count": 642.0, "op_density.eq": 0.0, "op_density.lor": 0.0, "op_density.sub": 0.0, "op_density.lnot": 0.0, "identifier_count": 20.0, "op_density.concat": 0.02, "string_literal_count": 53.0, "array_literal_max_length": 20.0 }, "file": { "size": 2094.0, "entropy": 4.57, "size_bytes": 2094.0 }, "text": { "digit_ratio": 0.06, "space_count": 673.0, "total_lines": 78.0, "char_entropy": 4.57, "unique_chars": 70.0, "string_density": 0.68, "avg_line_length": 25.85, "max_line_length": 76.0, "empty_line_ratio": 0.08, "last_line_length": 2.0, "whitespace_ratio": 0.36, "most_common_ratio": 0.04, "identifier_density": 0.9, "line_length_stddev": 20.12, "normalized_string_count": 6.0, "repeated_char_sequences": 47.0, "most_common_char_is_null": 0.0, "max_inline_whitespace_run": 2.0, "most_common_char_codepoint": 39.0, "suspicious_identifier_ratio": 0.07, "normalized_unique_identifiers": 4.3 }, "binds": { "count": 5.0 }, "calls": { "count": 12.0 }, "binary": { "overall_entropy": 4.57 }, "source": { "function_count": 1.0 }, "strings": { "total": 53.0, "avg_length": 14.17, "max_length": 55.0, "avg_entropy": 2.31, "empty_count": 3.0, "total_bytes": 751.0, "entropy_stddev": 1.47 }, "functions": { "count": 1.0, "avg_name_length": 13.0, "no_params_count": 1.0, "avg_length_lines": 72.0, "max_length_lines": 72.0, "min_length_lines": 72.0, "density_per_100_lines": 1.28, "code_in_functions_ratio": 0.92 }, "identifiers": { "count": 20.0, "total": 70.0, "avg_length": 7.33, "max_length": 14.0, "min_length": 1.0, "avg_entropy": 2.29, "reuse_ratio": 0.39, "unique_count": 27.0, "length_stddev": 3.85, "sequential_names": 2.0, "single_char_count": 2.0, "single_char_ratio": 0.07, "all_lowercase_ratio": 0.7, "all_uppercase_ratio": 0.04 } }, "str": [ [ 63, "10", "1" ], [ 101, "u8", "#^.*\u003cbody\u003e(.*)\u003c/body\u003e.*$#ms" ], [ 102, "u8", "#^.*\u003cbody\u003e(.*)\u003c/body\u003e.*$#ms" ], [ 142, "u8", "#\u003ch2\u003ePHP License\u003c/h2\u003e.*$#ms" ], [ 143, "u8", "#\u003ch2\u003ePHP License\u003c/h2\u003e.*$#ms" ], [ 183, "u8", "#\u003ch1\u003eConfiguration\u003c/h1\u003e#" ], [ 184, "u8", "#\u003ch1\u003eConfiguration\u003c/h1\u003e#" ], [ 221, "u8", "#\\r?\\n#" ], [ 222, "u8", "#" ], [ 225, "u8", "?" ], [ 228, "u8", "#" ], [ 242, "u8", "#\u003c/(h1|h2|h3|tr)\u003e#" ], [ 243, "u8", "#\u003c/(h1|h2|h3|tr)\u003e#" ], [ 274, "u8", "# +\u003c#" ], [ 275, "u8", "# +\u003c#" ], [ 293, "u8", "#\u003e +#" ], [ 294, "u8", "#\u003e +#" ], [ 312, "u8", "#[ \\t]+#" ], [ 313, "u8", "#[ " ], [ 318, "u8", "]+#" ], [ 334, "u8", "#\u0026nbsp;#" ], [ 335, "u8", "#\u0026nbsp;#" ], [ 356, "u8", "# +#" ], [ 357, "u8", "# +#" ], [ 375, "u8", "# class=\".*?\"#" ], [ 376, "u8", "# class=\".*?\"#" ], [ 403, "u8", "%\u0026#039;%" ], [ 404, "u8", "%\u0026#039;%" ], [ 425, "u8", "#\u003ctr\u003e(?:.*?)\" src=\"(?:.*?)=(.*?)\" alt=\"PHP Logo\" /\u003e\u003c/a\u003e" ], [ 426, "u8", "#\u003ctr\u003e(?:.*?)\" src=\"(?:.*?)=(.*?)\" alt=\"PHP Logo\" /\u003e\u003c/a\u003e" ], [ 496, "u8", "\u003ch1\u003ePHP Version (.*?)\u003c/h1\u003e(?:\\n+?)\u003c/td\u003e\u003c/tr\u003e#" ], [ 497, "u8", "\u003ch1\u003ePHP Version (.*?)\u003c/h1\u003e(?:\\n+?)\u003c/td\u003e\u003c/tr\u003e#" ], [ 555, "u8", "#\u003ch1\u003e\u003ca href=\"(?:.*?)\\?=(.*?)\"\u003ePHP Credits\u003c/a\u003e\u003c/h1\u003e#" ], [ 556, "u8", "#\u003ch1\u003e\u003ca href=\"(?:.*?)\\?=(.*?)\"\u003ePHP Credits\u003c/a\u003e\u003c/h1\u003e#" ], [ 621, "u8", "#\u003ctr\u003e(?:.*?)\" src=\"(?:.*?)=(.*?)\"(?:.*?)" ], [ 622, "u8", "#\u003ctr\u003e(?:.*?)\" src=\"(?:.*?)=(.*?)\"(?:.*?)" ], [ 677, "u8", "Zend Engine (.*?),(?:.*?)\u003c/tr\u003e#" ], [ 678, "u8", "Zend Engine (.*?),(?:.*?)\u003c/tr\u003e#" ], [ 722, "u8", "# +#" ], [ 723, "u8", "# +#" ], [ 740, "u8", "#\u003ctr\u003e#" ], [ 741, "u8", "#\u003ctr\u003e#" ], [ 760, "u8", "#\u003c/tr\u003e#" ], [ 761, "u8", "#\u003c/tr\u003e#" ], [ 781, "u8", "#\u003cbr /\u003e#" ], [ 782, "u8", "#\u003cbr /\u003e#" ], [ 803, "u8", "#Copyright#" ], [ 804, "u8", "#Copyright#" ], [ 829, "u8", "$1" ], [ 830, "u8", "$1" ], [ 887, "u8", "\u003c/$1\u003e" ], [ 888, "u8", "\u003c/$1\u003e" ], [ 895, "u8", "\\n" ], [ 911, "u8", " \u003c" ], [ 912, "u8", " \u003c" ], [ 927, "u8", "\u003e " ], [ 928, "u8", "\u003e " ], [ 943, "u8", " " ], [ 944, "u8", " " ], [ 958, "u8", " " ], [ 959, "u8", " " ], [ 973, "u8", " " ], [ 974, "u8", " " ], [ 1002, "u8", " " ], [ 1003, "u8", " " ], [ 1017, "u8", "\u003ch2\u003ePHP Configuration\u003c/h2\u003e" ], [ 1018, "u8", "\u003ch2\u003ePHP Configuration\u003c/h2\u003e" ], [ 1046, "u8", "\\n" ], [ 1051, "u8", "\u003ctr\u003e\u003ctd\u003ePHP Version\u003c/td\u003e\u003ctd\u003e$2" ], [ 1052, "u8", "\u003ctr\u003e\u003ctd\u003ePHP Version\u003c/td\u003e\u003ctd\u003e$2" ], [ 1097, "u8", "\u003c/td\u003e\u003c/tr\u003e" ], [ 1098, "u8", "\u003c/td\u003e\u003c/tr\u003e" ], [ 1110, "u8", "\\n" ], [ 1115, "u8", "\u003ctr\u003e\u003ctd\u003ePHP Egg\u003c/td\u003e\u003ctd\u003e$1\u003c/td\u003e\u003c/tr\u003e" ], [ 1116, "u8", "\u003ctr\u003e\u003ctd\u003ePHP Egg\u003c/td\u003e\u003ctd\u003e$1\u003c/td\u003e\u003c/tr\u003e" ], [ 1165, "u8", "\u003ctr\u003e\u003ctd\u003ePHP Credits Egg\u003c/td\u003e\u003ctd\u003e$1\u003c/td\u003e\u003c/tr\u003e" ], [ 1166, "u8", "\u003ctr\u003e\u003ctd\u003ePHP Credits Egg\u003c/td\u003e\u003ctd\u003e$1\u003c/td\u003e\u003c/tr\u003e" ], [ 1223, "u8", "\u003ctr\u003e\u003ctd\u003eZend Engine\u003c/td\u003e\u003ctd\u003e$2\u003c/td\u003e\u003c/tr\u003e" ], [ 1224, "u8", "\u003ctr\u003e\u003ctd\u003eZend Engine\u003c/td\u003e\u003ctd\u003e$2\u003c/td\u003e\u003c/tr\u003e" ], [ 1266, "u8", "\\n" ], [ 1284, "u8", "\u003ctr\u003e\u003ctd\u003eZend Egg\u003c/td\u003e\u003ctd\u003e$1\u003c/td\u003e\u003c/tr\u003e" ], [ 1285, "u8", "\u003ctr\u003e\u003ctd\u003eZend Egg\u003c/td\u003e\u003ctd\u003e$1\u003c/td\u003e\u003c/tr\u003e" ], [ 1335, "u8", " " ], [ 1336, "u8", " " ], [ 1350, "u8", "%S%" ], [ 1351, "u8", "%S%" ], [ 1367, "u8", "%E%" ], [ 1368, "u8", "%E%" ], [ 1384, "u8", " " ], [ 1385, "u8", " " ], [ 1399, "u8", " Copyright" ], [ 1400, "u8", " Copyright" ], [ 1460, "u8", "\u003ch2\u003e" ], [ 1461, "u8", "\u003ch2\u003e" ], [ 1484, "u8", "\u003ch2\u003e\u003cth\u003e\u003ctd\u003e" ], [ 1485, "u8", "\u003ch2\u003e\u003cth\u003e\u003ctd\u003e" ], [ 1522, "10", "0" ], [ 1618, "10", "0" ], [ 1638, "u8", "\u003c/h2\u003e" ], [ 1639, "u8", "\u003c/h2\u003e" ], [ 1666, "u8", "#%S%(?:\u003ctd\u003e(.*?)\u003c/td\u003e)?(?:\u003ctd\u003e(.*?)" ], [ 1667, "u8", "#%S%(?:\u003ctd\u003e(.*?)\u003c/td\u003e)?(?:\u003ctd\u003e(.*?)" ], [ 1723, "u8", "\u003c/td\u003e)?(?:\u003ctd\u003e(.*?)\u003c/td\u003e)?%E%#" ], [ 1724, "u8", "\u003c/td\u003e)?(?:\u003ctd\u003e(.*?)\u003c/td\u003e)?%E%#" ], [ 1897, "10", "3" ], [ 1907, "10", "2" ], [ 1916, "10", "3" ], [ 1947, "10", "1" ], [ 1956, "10", "2" ], [ 2004, "10", "1" ], [ 2026, "10", "2" ] ], "tgt": [ "array_slice", "explode", "isset", "ob_get_clean", "ob_start", "phpinfo", "phpinfo_array", "preg_match_all", "preg_replace", "strip_tags", "strpos", "substr" ], "val": { "file.stem": "array_format", "file.basename": "array_format.php", "source.language": "php", "source.imports[0]": "array_slice", "source.imports[1]": "explode", "source.imports[2]": "isset", "source.imports[3]": "ob_get_clean", "source.imports[4]": "ob_start", "source.imports[5]": "phpinfo", "source.imports[6]": "phpinfo_array", "source.imports[7]": "preg_match_all", "source.imports[8]": "preg_replace", "source.imports[9]": "strip_tags", "source.strings[0]": " Copyright", "source.strings[1]": "# class=\".*?\"#", "source.strings[2]": "#%S%(?:\u003ctd\u003e(.*?)\u003c/td\u003e)?(?:\u003ctd\u003e(.*?)", "source.strings[3]": "#\u0026nbsp;#", "source.strings[4]": "#\u003c/(h1|h2|h3|tr)\u003e#", "source.strings[5]": "#\u003c/tr\u003e#", "source.strings[6]": "#\u003cbr /\u003e#", "source.strings[7]": "#\u003ch1\u003e\u003ca href=\"(?:.*?)\\?=(.*?)\"\u003ePHP Credits\u003c/a\u003e\u003c/h1\u003e#", "source.strings[8]": "#\u003ch1\u003eConfiguration\u003c/h1\u003e#", "source.strings[9]": "#\u003ch2\u003ePHP License\u003c/h2\u003e.*$#ms", "source.has_imports": true, "source.imports[10]": "strpos", "source.imports[11]": "substr", "source.strings[10]": "#\u003ctr\u003e#", "source.strings[11]": "#\u003ctr\u003e(?:.*?)\" src=\"(?:.*?)=(.*?)\" alt=\"PHP Logo\" /\u003e\u003c/a\u003e", "source.strings[12]": "#\u003ctr\u003e(?:.*?)\" src=\"(?:.*?)=(.*?)\"(?:.*?)", "source.strings[13]": "#Copyright#", "source.strings[14]": "#[ \\t]+#", "source.strings[15]": "#\\r?\\n#", "source.strings[16]": "#^.*\u003cbody\u003e(.*)\u003c/body\u003e.*$#ms", "source.strings[17]": "%\u0026#039;%", "source.strings[18]": "\u003c/td\u003e)?(?:\u003ctd\u003e(.*?)\u003c/td\u003e)?%E%#", "source.strings[19]": "\u003c/td\u003e\u003c/tr\u003e", "source.strings[20]": "\u003ch1\u003ePHP Version (.*?)\u003c/h1\u003e(?:\\n+?)\u003c/td\u003e\u003c/tr\u003e#", "source.strings[21]": "\u003ch2\u003e\u003cth\u003e\u003ctd\u003e", "source.strings[22]": "\u003ch2\u003ePHP Configuration\u003c/h2\u003e", "source.strings[23]": "\u003ctr\u003e\u003ctd\u003ePHP Credits Egg\u003c/td\u003e\u003ctd\u003e$1\u003c/td\u003e\u003c/tr\u003e", "source.strings[24]": "\u003ctr\u003e\u003ctd\u003ePHP Egg\u003c/td\u003e\u003ctd\u003e$1\u003c/td\u003e\u003c/tr\u003e", "source.strings[25]": "\u003ctr\u003e\u003ctd\u003ePHP Version\u003c/td\u003e\u003ctd\u003e$2", "source.strings[26]": "\u003ctr\u003e\u003ctd\u003eZend Egg\u003c/td\u003e\u003ctd\u003e$1\u003c/td\u003e\u003c/tr\u003e", "source.strings[27]": "\u003ctr\u003e\u003ctd\u003eZend Engine\u003c/td\u003e\u003ctd\u003e$2\u003c/td\u003e\u003c/tr\u003e", "source.strings[28]": "Zend Engine (.*?),(?:.*?)\u003c/tr\u003e#", "source.functions[0]": "phpinfo_array" } }, "find": [ { "id": "objectives/discovery/system/fingerprint/info::phpinfo-call", "atk": "T1082", "mbc": "E1082", "conf": 0.699999988079071, "crit": 3, "desc": "Dumps PHP configuration via phpinfo()" }, { "id": "micro-behaviors/process/io/buffer::ob-get-clean", "conf": 0.6000000238418579, "crit": 3, "desc": "Gets and cleans output buffer" }, { "id": "micro-behaviors/process/io/buffer::ob-start", "conf": 0.699999988079071, "crit": 3, "desc": "Starts output buffering" }, { "id": "micro-behaviors/data/format/html::html-generator-tags", "conf": 0.6000000238418579, "crit": 3, "desc": "Generates HTML tags" }, { "id": "micro-behaviors/process/io/buffer::output-buffer-capture", "conf": 0.75, "crit": 3, "desc": "Output buffer capture pattern" } ], "path": "array_format.php", "risk": 3, "size": 2094, "type": "php" } ] } }