diff options
| author | jvoisin | 2020-02-11 12:19:42 +0000 |
|---|---|---|
| committer | GitHub | 2020-02-11 12:19:42 +0000 |
| commit | 8c6c048eecb1bb4d74002e939d81df13321273e6 (patch) | |
| tree | 964fab4629bfb8e0237f402bbd597db185c4d047 /README.md | |
| parent | c00804e79af0dbb861605aa2e0bf76ac4a7504db (diff) | |
Fix some links in the readme
Diffstat (limited to 'README.md')
| -rw-r--r-- | README.md | 12 |
1 files changed, 6 insertions, 6 deletions
| @@ -50,7 +50,7 @@ both) category, and should re-read the previous statement. | |||
| 50 | ## How does it work? | 50 | ## How does it work? |
| 51 | 51 | ||
| 52 | Detection is performed by crawling the filesystem and testing files against a | 52 | Detection is performed by crawling the filesystem and testing files against a |
| 53 | [set](https://github.com/nbs-system/php-malware-finder/blob/master/php-malware-finder/php.yar) | 53 | [set](https://github.com/jvoisin/php-malware-finder/blob/master/php-malware-finder/php.yar) |
| 54 | of [YARA](http://virustotal.github.io/yara/) rules. Yes, it's that simple! | 54 | of [YARA](http://virustotal.github.io/yara/) rules. Yes, it's that simple! |
| 55 | 55 | ||
| 56 | Instead of using an *hash-based* approach, | 56 | Instead of using an *hash-based* approach, |
| @@ -73,7 +73,7 @@ YACC=bison ./configure | |||
| 73 | make | 73 | make |
| 74 | ``` | 74 | ``` |
| 75 | 75 | ||
| 76 | - Download php-malware-finder `git clone https://github.com/nbs-system/php-malware-finder.git` | 76 | - Download php-malware-finder `git clone https://github.com/jvoisin/php-malware-finder.git` |
| 77 | 77 | ||
| 78 | ## How to use it? | 78 | ## How to use it? |
| 79 | 79 | ||
| @@ -103,9 +103,9 @@ Oh, and by the way, you can run the *comprehensive* testsuite with `make tests`. | |||
| 103 | 103 | ||
| 104 | ## Whitelisting | 104 | ## Whitelisting |
| 105 | 105 | ||
| 106 | Check the [whitelist.yar](https://github.com/nbs-system/php-malware-finder/blob/master/php-malware-finder/whitelist.yar) file. | 106 | Check the [whitelist.yar](https://github.com/jvoisin/php-malware-finder/blob/master/php-malware-finder/whitelist.yar) file. |
| 107 | If you're lazy, you can generate whitelists for entire folders with the | 107 | If you're lazy, you can generate whitelists for entire folders with the |
| 108 | [generate_whitelist.py](https://github.com/nbs-system/php-malware-finder/blob/master/php-malware-finder/utils/generate_whitelist.py) script. | 108 | [generate_whitelist.py](https://github.com/jvoisin/php-malware-finder/blob/master/php-malware-finder/utils/generate_whitelist.py) script. |
| 109 | 109 | ||
| 110 | ## Why should I use it instead of something else? | 110 | ## Why should I use it instead of something else? |
| 111 | 111 | ||
| @@ -113,7 +113,7 @@ Because: | |||
| 113 | - It doesn't use [a single rule per sample]( | 113 | - It doesn't use [a single rule per sample]( |
| 114 | https://github.com/Neo23x0/signature-base/blob/e264d66a8ea3be93db8482ab3d639a2ed3e9c949/yara/thor-webshells.yar | 114 | https://github.com/Neo23x0/signature-base/blob/e264d66a8ea3be93db8482ab3d639a2ed3e9c949/yara/thor-webshells.yar |
| 115 | ), since it only cares about finding malicious patterns, not specific webshells | 115 | ), since it only cares about finding malicious patterns, not specific webshells |
| 116 | - It has a [complete testsuite](https://travis-ci.org/nbs-system/php-malware-finder), to avoid regressions | 116 | - It has a [complete testsuite](https://travis-ci.org/jvoisin/php-malware-finder), to avoid regressions |
| 117 | - Its whitelist system doesn't rely on filenames | 117 | - Its whitelist system doesn't rely on filenames |
| 118 | - It doesn't rely on (slow) [entropy computation]( https://en.wikipedia.org/wiki/Entropy_(information_theory) ) | 118 | - It doesn't rely on (slow) [entropy computation]( https://en.wikipedia.org/wiki/Entropy_(information_theory) ) |
| 119 | - It uses a ghetto-style static analysis, instead of relying on file hashes | 119 | - It uses a ghetto-style static analysis, instead of relying on file hashes |
| @@ -122,7 +122,7 @@ Because: | |||
| 122 | ## Licensing | 122 | ## Licensing |
| 123 | 123 | ||
| 124 | PHP-malware-finder is | 124 | PHP-malware-finder is |
| 125 | [licensed](https://github.com/nbs-system/php-malware-finder/blob/master/php-malware-finder/LICENSE) | 125 | [licensed](https://github.com/jvoisin/php-malware-finder/blob/master/php-malware-finder/LICENSE) |
| 126 | under the GNU Lesser General Public License v3. | 126 | under the GNU Lesser General Public License v3. |
| 127 | 127 | ||
| 128 | The _amazing_ YARA project is licensed under the Apache v2.0 license. | 128 | The _amazing_ YARA project is licensed under the Apache v2.0 license. |
