diff options
| author | Julien (jvoisin) Voisin | 2016-06-13 16:45:15 +0200 |
|---|---|---|
| committer | Julien (jvoisin) Voisin | 2016-06-13 16:45:15 +0200 |
| commit | 83451010b76fb987eda6afa42faae7958f9c82f2 (patch) | |
| tree | 07a1b54340695a699c7f607f9c983d5f2af12102 | |
| parent | d30fdefd9842844e2abd32615d953bd7b5397f68 (diff) | |
Improves a bit the detection of preg_replace stuff
| -rw-r--r-- | php-malware-finder/php.yar | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/php-malware-finder/php.yar b/php-malware-finder/php.yar index 2dc20e1..60e877f 100644 --- a/php-malware-finder/php.yar +++ b/php-malware-finder/php.yar | |||
| @@ -74,7 +74,7 @@ rule DodgyPhp | |||
| 74 | $iis_com = /IIS:\/\/localhost\/w3svc/ | 74 | $iis_com = /IIS:\/\/localhost\/w3svc/ |
| 75 | $include = /include\s*\(\s*[^\.]+\.(png|jpg|gif|bmp)/ // Clever includes | 75 | $include = /include\s*\(\s*[^\.]+\.(png|jpg|gif|bmp)/ // Clever includes |
| 76 | $ini_get = /ini_(get|set|restore)\s*\(\s*['"](safe_mode|open_basedir|disable_function|safe_mode_exec_dir|safe_mode_include_dir|register_globals|allow_url_include)/ nocase | 76 | $ini_get = /ini_(get|set|restore)\s*\(\s*['"](safe_mode|open_basedir|disable_function|safe_mode_exec_dir|safe_mode_include_dir|register_globals|allow_url_include)/ nocase |
| 77 | $pr = /(preg_replace(_callback)?|mb_ereg_replace|preg_filter)\s*\(\s*['"]\/[^\/]*\/e/ nocase // http://php.net/manual/en/function.preg-replace.php | 77 | $pr = /(preg_replace(_callback)?|mb_ereg_replace|preg_filter)\s*\(.+(\/|\\x2f)(e|\\x65)['"]/ nocase // http://php.net/manual/en/function.preg-replace.php |
| 78 | $safemode_bypass = /\x00\/\.\.\/|LD_PRELOAD/ | 78 | $safemode_bypass = /\x00\/\.\.\/|LD_PRELOAD/ |
| 79 | $shellshock = /\(\)\s*{\s*:\s*;\s*}\s*;/ | 79 | $shellshock = /\(\)\s*{\s*:\s*;\s*}\s*;/ |
| 80 | $udp_dos = /fsockopen\s*\(\s*['"]udp:\/\// | 80 | $udp_dos = /fsockopen\s*\(\s*['"]udp:\/\// |