diff options
| author | Julien (jvoisin) Voisin | 2016-08-30 15:44:55 +0200 |
|---|---|---|
| committer | Julien (jvoisin) Voisin | 2016-08-30 15:45:35 +0200 |
| commit | e5560e053a754ba3ab189e01cbfa9c5a95437a6c (patch) | |
| tree | 651b3fbd3c561a48b85ced0b592d8f61ec599f7d /README.md | |
| parent | 12c72b5cd4d94bbb26caa7687f1f708e17cca68d (diff) | |
Improve a bit the README file
Diffstat (limited to 'README.md')
| -rw-r--r-- | README.md | 13 |
1 files changed, 7 insertions, 6 deletions
| @@ -26,16 +26,17 @@ The following list of encoders/obfuscators/webshells are also detected: | |||
| 26 | * [Cipher Design]( http://cipherdesign.co.uk/service/php-obfuscator ) | 26 | * [Cipher Design]( http://cipherdesign.co.uk/service/php-obfuscator ) |
| 27 | * [Cyklodev]( http://sysadmin.cyklodev.com/online-php-obfuscator/ ) | 27 | * [Cyklodev]( http://sysadmin.cyklodev.com/online-php-obfuscator/ ) |
| 28 | * [Joes Web Tools Obfuscator]( http://www.joeswebtools.com/security/php-obfuscator/ ) | 28 | * [Joes Web Tools Obfuscator]( http://www.joeswebtools.com/security/php-obfuscator/ ) |
| 29 | * [P.A.S]( http://profexer.name/pas/download.php ) | ||
| 30 | * [PHP Jiami]( http://www.phpjiami.com/ ) | ||
| 29 | * [Php Obfuscator Encode]( http://w3webtools.com/encode-php-online/ ) | 31 | * [Php Obfuscator Encode]( http://w3webtools.com/encode-php-online/ ) |
| 30 | * [SpinObf]( http://mohssen.org/SpinObf.php ) | 32 | * [SpinObf]( http://mohssen.org/SpinObf.php ) |
| 31 | * [Weevely3]( https://github.com/epinna/weevely3 ) | 33 | * [Weevely3]( https://github.com/epinna/weevely3 ) |
| 32 | * [atomiku]( http://atomiku.com/online-php-code-obfuscator/ ) | 34 | * [atomiku]( http://atomiku.com/online-php-code-obfuscator/ ) |
| 33 | * [cobra obfuscator]( http://obfuscator.uk/example/ ) | 35 | * [cobra obfuscator]( http://obfuscator.uk/example/ ) |
| 34 | * [phpencode]( http://phpencode.org ) | 36 | * [phpencode]( http://phpencode.org ) |
| 35 | * [webtoolsvn]( http://www.webtoolsvn.com/en-decode/ ) | ||
| 36 | * [tennc]( http://tennc.github.io/webshell/ ) | 37 | * [tennc]( http://tennc.github.io/webshell/ ) |
| 37 | * [web-malware-collection]( https://github.com/nikicat/web-malware-collection ) | 38 | * [web-malware-collection]( https://github.com/nikicat/web-malware-collection ) |
| 38 | * [P.A.S]( http://profexer.name/pas/download.php ) | 39 | * [webtoolsvn]( http://www.webtoolsvn.com/en-decode/ ) |
| 39 | 40 | ||
| 40 | 41 | ||
| 41 | Of course it's **trivial** to bypass PMF, | 42 | Of course it's **trivial** to bypass PMF, |
| @@ -43,7 +44,7 @@ but its goal is to catch kiddies and idiots, | |||
| 43 | not people with a working brain. | 44 | not people with a working brain. |
| 44 | 45 | ||
| 45 | If you report a stupid tailored bypass for PMF, you likely belong to one (or | 46 | If you report a stupid tailored bypass for PMF, you likely belong to one (or |
| 46 | both) category, and should re-read the previous sentence. | 47 | both) category, and should re-read the previous statement. |
| 47 | 48 | ||
| 48 | ## How does it work? | 49 | ## How does it work? |
| 49 | 50 | ||
| @@ -83,7 +84,7 @@ whitelist system, and greedy regexps. Please note that if you plan to build | |||
| 83 | yara from sources, libssl-dev must be installed on your system in order to | 84 | yara from sources, libssl-dev must be installed on your system in order to |
| 84 | have support for hashes. | 85 | have support for hashes. |
| 85 | 86 | ||
| 86 | Ho, and by the way, you can run the comprehensive testsuite with `make test`. | 87 | Ho, and by the way, you can run the *comprehensive* testsuite with `make test`. |
| 87 | 88 | ||
| 88 | ## Whitelisting | 89 | ## Whitelisting |
| 89 | 90 | ||
| @@ -97,9 +98,9 @@ Because: | |||
| 97 | https://github.com/Neo23x0/signature-base/blob/e264d66a8ea3be93db8482ab3d639a2ed3e9c949/yara/thor-webshells.yar | 98 | https://github.com/Neo23x0/signature-base/blob/e264d66a8ea3be93db8482ab3d639a2ed3e9c949/yara/thor-webshells.yar |
| 98 | ), since it only cares about finding malicious patterns, not specific webshells | 99 | ), since it only cares about finding malicious patterns, not specific webshells |
| 99 | - Its whitelist system doesn't rely on filenames | 100 | - Its whitelist system doesn't rely on filenames |
| 100 | - It doesn't rely on (slow) entropy calculation | 101 | - It doesn't rely on (slow) [entropy computation]( https://en.wikipedia.org/wiki/Entropy_(information_theory) ) |
| 101 | - It uses a ghetto-style static analysis, instead of relying on file hashes | 102 | - It uses a ghetto-style static analysis, instead of relying on file hashes |
| 102 | - Thanks to the aforementioned pseudo-static analysis, it works on obfuscated files too | 103 | - Thanks to the aforementioned pseudo-static analysis, it works (especially) on obfuscated files too |
| 103 | 104 | ||
| 104 | ## Licensing | 105 | ## Licensing |
| 105 | 106 | ||
