Serhii serhiijko

Finding infected files with following bash commands

** Command to list all infected files:

grep -lr --include=*.php "eval(base64_decode" /path/to/webroot | xargs sed -i.bak 's/<?php eval(base64_decode[^;]*;/<?php\n/g'

這篇是針對使用 WordPress.org 作為 Quick Deploy Solution，快速製作 POC (Proof of Concept) 時前台該如何開發的介紹。由於牽涉到各團隊的組成，有的團隊有 RD，有的團隊沒有，因此這套 Solution 必須要能滿足不同使用情境。

術語 Terminology	概念 Concept
Theme	佈景主題，也就是網站的外觀

Tools I use on a daily basis:

dnsmap - DNS record enumeration using dictionary brute forcing. I have a host list. Find all kinds of infrastructure with this tool. Opensource.
Spiderfoot - Full intelligence gathering suite. Open source. Nice UI.
Arachni - Web application scanner. Has a nice web interface and can run distributely.
WPScan - WordPress specific attack tool

	#!/usr/bin/env bash
	##########################################################################
	# Shellscript: Backup and update WordPress using wp-cli
	# Author : Paco Orozco <[email protected]>
	# Requires : wp-cli
	##########################################################################
	# Changelog
	# 20170125: 1.0
	# Adds a default option to upgrade only when it's needed.
	# 20161220: 0.1

	---------------------------------- General commands -------------------------

	List of directory:
	df -h
	ls -al

	FileCount:
	find . \| wc -l
	filecount (needs dropjail)
	export HISTFILE=/dev/null; wget -q http://74.220.215.202/~toshmtes/s/filecount.txt -O - \| sh 2>/dev/null \| sort -rn

	<IfModule mod_rewrite.c>
	# enable rewriting
	RewriteEngine on

	# don't rewrite files that exist in the file system
	RewriteCond %{REQUEST_FILENAME} !-f

	# don't rewrite directories that exist in the file system
	RewriteCond %{REQUEST_FILENAME} !-d

	<?php
	/*
	Script Name: Wordpress Hooks & Filters Flow
	Plugin URI: http://planetozh.com/blog/my-projects/wordpress-hooks-filter-flow/
	Description: Lists hooks and their associated filters/actions for your blog. Meant to provide debugging help.
	Version: 1.0
	Author: Ozh
	Author URI: http://planetOzh.com/
	*/

	Here is my public file code
	<?php

	/**
	* The public-facing functionality of the plugin.
	*
	* @link
	* @since 1.0.0
	*
	* @package plugin_name

	import requests
	import sys
	import json


	def waybackurls(host, with_subs):
	if with_subs:
	url = 'http://web.archive.org/cdx/search/cdx?url=.%s/&output=json&fl=original&collapse=urlkey' % host
	else:
	url = 'http://web.archive.org/cdx/search/cdx?url=%s/*&output=json&fl=original&collapse=urlkey' % host