Search for encoded code

encoded-code-search.sh

# Hackers often base64 encode malicious code to make it
# harder to find. Try these commands on your sites root folder
# to find base64 occurences. Look out for large code blocks
# in the output and check the code.
# You can search in php files only, but if the site is not too
# huge, I would recommend to search through all your files.

# 1. option
# Use this option for Linux based systems, where grep -r is
# available. The use command are:
# -i  Case insensetive
# -r  Recursive (includes subfolders)
# -n  Display line-numbers
# --color=auto  Color the found instance, if possible.
# *  The filename – a wildcard in this case. Use "*.php" to search php files only.
grep -r -i -n --color=auto "base64_decode" "*"
grep -r -i -n --color=auto "eval" "*"

# For Systems that do not support grep -r use this
# command. It will do pretty much the same.
find . -name "*" -exec grep -i "base64_decode" '{}' \;
find . -name "*" -exec grep -i "eval" '{}' \;