Skip to content

Instantly share code, notes, and snippets.

@kikoseijo

kikoseijo/find_suspicious_php

Created March 28, 2017 22:40
Show Gist options
  • Save kikoseijo/1f069a459a3f6bc8bfd81938e993bbd7 to your computer and use it in GitHub Desktop.
Save kikoseijo/1f069a459a3f6bc8bfd81938e993bbd7 to your computer and use it in GitHub Desktop.
Download ZIP
Raw
find_suspicious_php
#!/bin/bash
IFS=$'\n'
while read php_file
do
egrep -i "(mail|eval|base64_decode|str_rot13|chmod|fwrite|exec|passthru|shell_exec|system|proc_open|popen|curl_exec|curl_multi_exec|show_source|fsockopen|pfsockopen|stream_socket_client) *\(" "$php_file"
done < php_in_writable.txt
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment