summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorjvoisin2018-02-21 12:18:52 +0100
committerjvoisin2018-02-21 12:18:52 +0100
commit3467d442aac125413e4368a4ac3c21ab0ba72560 (patch)
tree93fb4ef52e004034696e8dd854b57b7334a2c29a
parentf7e6683be7b84042513294b2f15e238f81a0b875 (diff)
Update a bit the README
-rw-r--r--README.md8
1 files changed, 3 insertions, 5 deletions
diff --git a/README.md b/README.md
index 4669f42..c6daaeb 100644
--- a/README.md
+++ b/README.md
@@ -1,5 +1,4 @@
1[![Build Status](https://travis-ci.org/nbs-system/php-malware-finder.svg?branch=master)](https://travis-ci.org/nbs-system/php-malware-finder) 1[![Build Status](https://travis-ci.org/nbs-system/php-malware-finder.svg?branch=master)](https://travis-ci.org/nbs-system/php-malware-finder)
2[![Gitter](https://badges.gitter.im/nbs-system/php-malware-finder.svg)](https://gitter.im/nbs-system/php-malware-finder?utm_source=badge&utm_medium=badge&utm_campaign=pr-badge)
3 2
4# PHP Malware Finder 3# PHP Malware Finder
5 4
@@ -63,20 +62,18 @@ and then passed to some dangerous function like `system`".
63 62
64``` 63```
65$ ./phpmalwarefinder -h 64$ ./phpmalwarefinder -h
66Usage phpmalwarefinder [-cfhtv] [-l (php|asp)] <file|folder> ... 65Usage phpmalwarefinder [-cfhtvl] <file|folder> ...
67 -c Optional path to a configuration file 66 -c Optional path to a rule file
68 -f Fast mode 67 -f Fast mode
69 -h Show this help message 68 -h Show this help message
70 -t Specify the number of threads to use (8 by default) 69 -t Specify the number of threads to use (8 by default)
71 -v Verbose mode 70 -v Verbose mode
72 -l Set language ('asp', 'php')
73``` 71```
74 72
75Or if you prefer to use `yara`: 73Or if you prefer to use `yara`:
76 74
77``` 75```
78$ yara -r ./php.yar /var/www 76$ yara -r ./php.yar /var/www
79$ yara -r ./asp.yar /var/www
80``` 77```
81 78
82Please keep in mind that you should use at least YARA 3.4 because we're using 79Please keep in mind that you should use at least YARA 3.4 because we're using
@@ -94,6 +91,7 @@ If you're lazy, you can generate whitelists for entire folders with the
94[generate_whitelist.py](https://github.com/nbs-system/php-malware-finder/blob/master/php-malware-finder/generate_whitelist.py) script. 91[generate_whitelist.py](https://github.com/nbs-system/php-malware-finder/blob/master/php-malware-finder/generate_whitelist.py) script.
95 92
96## Why should I use it instead of something else? 93## Why should I use it instead of something else?
94
97Because: 95Because:
98- It doesn't use [a single rule per sample]( 96- It doesn't use [a single rule per sample](
99 https://github.com/Neo23x0/signature-base/blob/e264d66a8ea3be93db8482ab3d639a2ed3e9c949/yara/thor-webshells.yar 97 https://github.com/Neo23x0/signature-base/blob/e264d66a8ea3be93db8482ab3d639a2ed3e9c949/yara/thor-webshells.yar