diff options
| author | jvoisin | 2018-02-21 12:18:52 +0100 |
|---|---|---|
| committer | jvoisin | 2018-02-21 12:18:52 +0100 |
| commit | 3467d442aac125413e4368a4ac3c21ab0ba72560 (patch) | |
| tree | 93fb4ef52e004034696e8dd854b57b7334a2c29a /README.md | |
| parent | f7e6683be7b84042513294b2f15e238f81a0b875 (diff) | |
Update a bit the README
Diffstat (limited to 'README.md')
| -rw-r--r-- | README.md | 8 |
1 files changed, 3 insertions, 5 deletions
| @@ -1,5 +1,4 @@ | |||
| 1 | [](https://travis-ci.org/nbs-system/php-malware-finder) | 1 | [](https://travis-ci.org/nbs-system/php-malware-finder) |
| 2 | [](https://gitter.im/nbs-system/php-malware-finder?utm_source=badge&utm_medium=badge&utm_campaign=pr-badge) | ||
| 3 | 2 | ||
| 4 | # PHP Malware Finder | 3 | # PHP Malware Finder |
| 5 | 4 | ||
| @@ -63,20 +62,18 @@ and then passed to some dangerous function like `system`". | |||
| 63 | 62 | ||
| 64 | ``` | 63 | ``` |
| 65 | $ ./phpmalwarefinder -h | 64 | $ ./phpmalwarefinder -h |
| 66 | Usage phpmalwarefinder [-cfhtv] [-l (php|asp)] <file|folder> ... | 65 | Usage phpmalwarefinder [-cfhtvl] <file|folder> ... |
| 67 | -c Optional path to a configuration file | 66 | -c Optional path to a rule file |
| 68 | -f Fast mode | 67 | -f Fast mode |
| 69 | -h Show this help message | 68 | -h Show this help message |
| 70 | -t Specify the number of threads to use (8 by default) | 69 | -t Specify the number of threads to use (8 by default) |
| 71 | -v Verbose mode | 70 | -v Verbose mode |
| 72 | -l Set language ('asp', 'php') | ||
| 73 | ``` | 71 | ``` |
| 74 | 72 | ||
| 75 | Or if you prefer to use `yara`: | 73 | Or if you prefer to use `yara`: |
| 76 | 74 | ||
| 77 | ``` | 75 | ``` |
| 78 | $ yara -r ./php.yar /var/www | 76 | $ yara -r ./php.yar /var/www |
| 79 | $ yara -r ./asp.yar /var/www | ||
| 80 | ``` | 77 | ``` |
| 81 | 78 | ||
| 82 | Please keep in mind that you should use at least YARA 3.4 because we're using | 79 | Please keep in mind that you should use at least YARA 3.4 because we're using |
| @@ -94,6 +91,7 @@ If you're lazy, you can generate whitelists for entire folders with the | |||
| 94 | [generate_whitelist.py](https://github.com/nbs-system/php-malware-finder/blob/master/php-malware-finder/generate_whitelist.py) script. | 91 | [generate_whitelist.py](https://github.com/nbs-system/php-malware-finder/blob/master/php-malware-finder/generate_whitelist.py) script. |
| 95 | 92 | ||
| 96 | ## Why should I use it instead of something else? | 93 | ## Why should I use it instead of something else? |
| 94 | |||
| 97 | Because: | 95 | Because: |
| 98 | - It doesn't use [a single rule per sample]( | 96 | - It doesn't use [a single rule per sample]( |
| 99 | https://github.com/Neo23x0/signature-base/blob/e264d66a8ea3be93db8482ab3d639a2ed3e9c949/yara/thor-webshells.yar | 97 | https://github.com/Neo23x0/signature-base/blob/e264d66a8ea3be93db8482ab3d639a2ed3e9c949/yara/thor-webshells.yar |
