read and download website directory content : is possible ?

[yuco91]

Hi guys !
 
 I'm new on the forum. I state that I'm a very noob of hacking world so don't blame me for this question.
 
 I'm developing a website in PHP and I wonder if there's a way to attack the server and try to read and "download" the full sources of my site. Maybe there are some tools for this or this is pratically impossible ? If someone can do this, there a way to protect the site against these kind of attacks?
 
 Thx in advance for your attention 

[rasenove]

First go post a long intro (atleast 500 words) in the introduction board.

[vezzy]

Hint: HTTP verb tampering.

At least that's one way.

[yuco91]

Hint: HTTP verb tampering.

At least that's one way.

thanks for this hint. I think this can be a good start point. 

[Thor]

You should check you have disabled directory listing on your server. Although it shouldn't allow someone to read the source code, it makes it easy to map the web application and may expose some sensitive files.

[Kulverstukas]

PHP files cannot be viewed on the client side unless you put the PHP files in a directory listing for download. If PHP files are there to provide content , then the user will only see what content gets generated.

[yuco91]

great ! I make this question because I listened from a friend that some hackers can do this and leak all source code from website with the aim to blackmail the original developers or for resell the code to other people.

[proxx]

Dont believe anything you hear.

[arty]

But do believe the things you see.

[Kulverstukas]

But do believe the things you see.

[Stackprotector]

great ! I make this question because I listened from a friend that some hackers can do this and leak all source code from website with the aim to blackmail the original developers or for resell the code to other people.

Yes, but this won't happen to you with 10 visitors a year. Getting the source code would usually go though LFI, or a full path disclosure and the hacker finding php file with a wrong extension like .php.bak, .php~ wich are not in the MIME filetype list of PHP/Apache so they are parsed as plain text and shown to the user on request.