The internal network scanner idea behind a PHP intranet tool
PHP内网扫描小脚本+密码破解小脚本
This note describes the thinking behind a browser-driven PHP tool meant to run from inside an already-compromised web server, rather than from an attacker's own machine. That distinction matters: once a webshell or similar foothold exists on a host that sits inside a corporate network, the attacker's vantage point changes from "outside looking in" to "inside looking around", and a surprising number of internal services turn out to trust that position implicitly.
The idea: scan from the inside, then try the obvious passwords
The concept has two parts. The first is a simple port sweep across a block of internal IP addresses, checking for commonly exposed services such as FTP, SSH, database servers, and administrative interfaces. The second is a credential-guessing pass limited to well-known default and empty credentials for those same services: anonymous FTP, an empty database root password, a default database administrator account, and similar out-of-the-box settings that are often never changed.
None of this relies on a software vulnerability. It relies entirely on services that were never hardened after installation, running on a network segment the organisation assumed was safe because it was internal. The tool itself is unremarkable; what it reveals about typical internal network hygiene is the actual point of interest.
Why this still matters
"Internal" is not a security boundary on its own. Once any single internet-facing application is compromised, anything reachable from that host inherits the same exposure, and internal services are routinely configured more loosely than internet-facing ones precisely because administrators assume outsiders cannot reach them. This assumption is the actual vulnerability, and it is also the easiest one to fix.
Defensive takeaways
Treat default credentials as a finding on every internal service, not just internet-facing ones: database engines, FTP daemons, and management consoles should never be left with vendor-default or empty passwords, and this should be checked on a schedule rather than once at install time. Network segmentation should limit which hosts can even reach sensitive internal services, so that compromising a public-facing web server does not open a direct path to a database or directory server. Outbound and lateral connection attempts from a web server to unrelated internal hosts and ports are a strong detection signal, since a normal web application has no reason to be port-scanning its neighbours. Logging failed authentication attempts against internal services, and alerting on bursts of them from a single host, catches this technique in the act rather than after the fact.
Key takeaways
- A web compromise often becomes a springboard for internal network scanning, not just a single-host problem
- Default and empty credentials on internal services are the actual vulnerability, not a missing patch
- Network segmentation should assume any single server can be compromised
- A web server making outbound scans to internal IPs is an abnormal, detectable pattern
- Audit internal service credentials on a schedule, not only at install time
中文摘要
文章讲的是入侵网站后，利用该主机对内网进行端口扫描并尝试常见弱口令/空口令的思路，核心问题是内网服务的默认口令和缺乏网络分段，而不是某个具体漏洞。
This note has been rewritten and checked for this edition; it is not a copy of the original post.