Skip to content

Instantly share code, notes, and snippets.

@imitronov
Created October 19, 2017 17:22
Show Gist options
  • Save imitronov/096c8edc459623438b09ef1455f4c1d5 to your computer and use it in GitHub Desktop.
Save imitronov/096c8edc459623438b09ef1455f4c1d5 to your computer and use it in GitHub Desktop.
Сканирование сайта на наличие исполняемого eval js кода
<?php
function scanVirus($dir) {
    $files = scandir($dir);
    foreach($files as $file) {
        if(is_file($dir.$file) and pathinfo($file, PATHINFO_EXTENSION) == 'js') {
            $content = trim(file_get_contents($dir.$file));
            $pattern = '#var ([a-zA-Z0-9]+)="(.[^\"]*)",([a-zA-Z0-9]+)="";for\(var ([a-zA-Z0-9]+)=(.*?).length-1;(.*?)>0;(.*?)--\){if\((.*?)%2==1\)(.*?)+=(.*?).charAt\((.*?)\)}eval\((.*?)\);#mi';
            if(preg_match($pattern, $content)) {
                $content = preg_replace($pattern, NULL, $content);
                file_put_contents($dir.$file, $content.PHP_EOL);
                echo '<a href="'.$dir.$file.'">'.$file.'</a><br>';
            }
        } else if($file != '.' AND $file != '..' AND is_dir($dir.$file)) {
            scanVirus($dir.$file.'/');
        }
    }
}
scanVirus('./');
?>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment