Determine if Drupal core files have been modified

gistfile1.txt

Based on http://www.geoffgolder.com/testing-if-your-drupal-core-is-hacked using a Mac and Drupal 6.x as the basis.

Download the tarball of the version of Drupal and untar it into its own directory. I'll use '6.22' as an example of an old version of Drupal to see if it was modified.

cd /path/to/clean/6.22
find . > /tmp/6.22.files.txt
cd /path/to/existing/project
find . > /tmp/project.files.txt
grep -x -f /tmp/6.22.files.txt /tmp/project.files.txt > /tmp/project.common.files.txt

cat /tmp/project.common.files.txt | xargs md5 > /tmp/project.common.md5.txt

cd /path/to/clean/6.22
cat /tmp/coexm.common.files | xargs md5 > /tmp/6.22.md5.txt

diff -u /tmp/project.common.md5.txt /tmp/6.22.md5.txt