logoalt Hacker News

randomblock1 • yesterday at 10:07 PM • 1 reply • view on HN

  $ curl -sS -D - -o /dev/null -X FOO https://stealmybitcoin.com/
  HTTP/1.1 501 Not Implemented
  Server: nginx
  Date: Sat, 24 Oct 2026 22:06:58 GMT
  Content-Type: text/html; charset=UTF-8
  Content-Length: 495
  Connection: keep-alive
  Host: stealmybitcoin.com
  X-Powered-By: PHP/8.4.26

Replies

LZ2DMV • yesterday at 10:20 PM

So expose_php is On and he filters X-Powered-By in the response when legal HTTP verbs are used, but nothing catches the illegal ones? Interesting.

➕ show 1 reply