Hacker News Reader

Assuming the reddit posters are correct. This means the PHP app knew the public IP. Isn't the only way to know about it to enter it into the web server configuration?

View on HN

No, there are several $_SERVER variables available to all php applications. The two relevant ones in this case would be HTTP_HOST and SERVER_ADDR, most likely the author of the application was leaking one of those in his application.

But a webserver does not know its external IP, that is the whole confusion. Don't PHP docs say:

'SERVER_NAME' The name of the server host under which the current script is executing. If the script is running on a virtual host, this will be the value defined for that virtual host.

'HTTP_HOST' Contents of the Host: header from the current request, if there is one.

1.) You're assuming that the script was running on a vhost, we don't know.

2.) Even if the script is running in a vhost, if a listening port is specified but not an IP address the SERVER_NAME will be the IP of whatever the interface the http connection came from was.

Reply on news.ycombinator.com