summaryrefslogtreecommitdiff
path: root/README.md
diff options
context:
space:
mode:
authorjvoisin2020-02-11 12:19:42 +0000
committerGitHub2020-02-11 12:19:42 +0000
commit8c6c048eecb1bb4d74002e939d81df13321273e6 (patch)
tree964fab4629bfb8e0237f402bbd597db185c4d047 /README.md
parentc00804e79af0dbb861605aa2e0bf76ac4a7504db (diff)
Fix some links in the readme
Diffstat (limited to 'README.md')
-rw-r--r--README.md12
1 files changed, 6 insertions, 6 deletions
diff --git a/README.md b/README.md
index eb085b8..deb7352 100644
--- a/README.md
+++ b/README.md
@@ -50,7 +50,7 @@ both) category, and should re-read the previous statement.
50## How does it work? 50## How does it work?
51 51
52Detection is performed by crawling the filesystem and testing files against a 52Detection is performed by crawling the filesystem and testing files against a
53[set](https://github.com/nbs-system/php-malware-finder/blob/master/php-malware-finder/php.yar) 53[set](https://github.com/jvoisin/php-malware-finder/blob/master/php-malware-finder/php.yar)
54of [YARA](http://virustotal.github.io/yara/) rules. Yes, it's that simple! 54of [YARA](http://virustotal.github.io/yara/) rules. Yes, it's that simple!
55 55
56Instead of using an *hash-based* approach, 56Instead of using an *hash-based* approach,
@@ -73,7 +73,7 @@ YACC=bison ./configure
73make 73make
74``` 74```
75 75
76- Download php-malware-finder `git clone https://github.com/nbs-system/php-malware-finder.git` 76- Download php-malware-finder `git clone https://github.com/jvoisin/php-malware-finder.git`
77 77
78## How to use it? 78## How to use it?
79 79
@@ -103,9 +103,9 @@ Oh, and by the way, you can run the *comprehensive* testsuite with `make tests`.
103 103
104## Whitelisting 104## Whitelisting
105 105
106Check the [whitelist.yar](https://github.com/nbs-system/php-malware-finder/blob/master/php-malware-finder/whitelist.yar) file. 106Check the [whitelist.yar](https://github.com/jvoisin/php-malware-finder/blob/master/php-malware-finder/whitelist.yar) file.
107If you're lazy, you can generate whitelists for entire folders with the 107If you're lazy, you can generate whitelists for entire folders with the
108[generate_whitelist.py](https://github.com/nbs-system/php-malware-finder/blob/master/php-malware-finder/utils/generate_whitelist.py) script. 108[generate_whitelist.py](https://github.com/jvoisin/php-malware-finder/blob/master/php-malware-finder/utils/generate_whitelist.py) script.
109 109
110## Why should I use it instead of something else? 110## Why should I use it instead of something else?
111 111
@@ -113,7 +113,7 @@ Because:
113- It doesn't use [a single rule per sample]( 113- It doesn't use [a single rule per sample](
114 https://github.com/Neo23x0/signature-base/blob/e264d66a8ea3be93db8482ab3d639a2ed3e9c949/yara/thor-webshells.yar 114 https://github.com/Neo23x0/signature-base/blob/e264d66a8ea3be93db8482ab3d639a2ed3e9c949/yara/thor-webshells.yar
115 ), since it only cares about finding malicious patterns, not specific webshells 115 ), since it only cares about finding malicious patterns, not specific webshells
116- It has a [complete testsuite](https://travis-ci.org/nbs-system/php-malware-finder), to avoid regressions 116- It has a [complete testsuite](https://travis-ci.org/jvoisin/php-malware-finder), to avoid regressions
117- Its whitelist system doesn't rely on filenames 117- Its whitelist system doesn't rely on filenames
118- It doesn't rely on (slow) [entropy computation]( https://en.wikipedia.org/wiki/Entropy_(information_theory) ) 118- It doesn't rely on (slow) [entropy computation]( https://en.wikipedia.org/wiki/Entropy_(information_theory) )
119- It uses a ghetto-style static analysis, instead of relying on file hashes 119- It uses a ghetto-style static analysis, instead of relying on file hashes
@@ -122,7 +122,7 @@ Because:
122## Licensing 122## Licensing
123 123
124PHP-malware-finder is 124PHP-malware-finder is
125[licensed](https://github.com/nbs-system/php-malware-finder/blob/master/php-malware-finder/LICENSE) 125[licensed](https://github.com/jvoisin/php-malware-finder/blob/master/php-malware-finder/LICENSE)
126under the GNU Lesser General Public License v3. 126under the GNU Lesser General Public License v3.
127 127
128The _amazing_ YARA project is licensed under the Apache v2.0 license. 128The _amazing_ YARA project is licensed under the Apache v2.0 license.