What bug does this hacker want to exploit?

The vulnerability the attacker is aiming for is probably some kind of remote file inclusion exploiting PHP’s include and similar functions/construct that allow to load a (remote) file and execute its contents:

Security warning

Remote file may be processed at the remote server (depending on the file extension and the fact if the remote server runs PHP or not) but it still has to produce a valid PHP script because it will be processed at the local server. If the file from the remote server should be processed there and outputted only, readfile() is much better function to use. Otherwise, special care should be taken to secure the remote script to produce a valid and desired code.

Note that using readfile does only avoids that the loaded file is executed. But it is still possible to exploit it to load other contents that are then printed directly to the user. This can be used to print the plain contents of files of any type in the local file system (i.e. Path Traversal) or to inject code into the page (i.e. Code Injection). So the only protection is to validate the parameter value before using it.

See also OWASP’s Development Guide on “File System – Includes and Remote files” for further information.

An obvious one, just unsanitized include.
He is checking if the code gets executed.
If he finds his signature in a response, he will know that your site is ready to run whatever code he sends.

To prevent such attacks one have to strictly sanitize filenames, if they happen to be sent via HTTP requests.

A quick and cheap validation can be done using basename() function:

if (empty($_GET['page'])) 
    $_GET['page']="index.php";
$page = $modules_dir.basename($_GET['page']).".php";
if (!is_readable($page)) {
    header("HTTP/1.0 404 Not Found");
    $page="404.html";
}
include $page;

or using some regular expression.

There is also an extremely useful PHP configuration directive called

allow_url_include

which is set to off by default in modern PHP versions. So it protects you from such attacks automatically.