summaryrefslogtreecommitdiff
path: root/README.md
diff options
context:
space:
mode:
authorJulien (jvoisin) Voisin2016-08-30 15:44:55 +0200
committerJulien (jvoisin) Voisin2016-08-30 15:45:35 +0200
commite5560e053a754ba3ab189e01cbfa9c5a95437a6c (patch)
tree651b3fbd3c561a48b85ced0b592d8f61ec599f7d /README.md
parent12c72b5cd4d94bbb26caa7687f1f708e17cca68d (diff)
Improve a bit the README file
Diffstat (limited to 'README.md')
-rw-r--r--README.md13
1 files changed, 7 insertions, 6 deletions
diff --git a/README.md b/README.md
index 3371ca7..5d6a4d9 100644
--- a/README.md
+++ b/README.md
@@ -26,16 +26,17 @@ The following list of encoders/obfuscators/webshells are also detected:
26* [Cipher Design]( http://cipherdesign.co.uk/service/php-obfuscator ) 26* [Cipher Design]( http://cipherdesign.co.uk/service/php-obfuscator )
27* [Cyklodev]( http://sysadmin.cyklodev.com/online-php-obfuscator/ ) 27* [Cyklodev]( http://sysadmin.cyklodev.com/online-php-obfuscator/ )
28* [Joes Web Tools Obfuscator]( http://www.joeswebtools.com/security/php-obfuscator/ ) 28* [Joes Web Tools Obfuscator]( http://www.joeswebtools.com/security/php-obfuscator/ )
29* [P.A.S]( http://profexer.name/pas/download.php )
30* [PHP Jiami]( http://www.phpjiami.com/ )
29* [Php Obfuscator Encode]( http://w3webtools.com/encode-php-online/ ) 31* [Php Obfuscator Encode]( http://w3webtools.com/encode-php-online/ )
30* [SpinObf]( http://mohssen.org/SpinObf.php ) 32* [SpinObf]( http://mohssen.org/SpinObf.php )
31* [Weevely3]( https://github.com/epinna/weevely3 ) 33* [Weevely3]( https://github.com/epinna/weevely3 )
32* [atomiku]( http://atomiku.com/online-php-code-obfuscator/ ) 34* [atomiku]( http://atomiku.com/online-php-code-obfuscator/ )
33* [cobra obfuscator]( http://obfuscator.uk/example/ ) 35* [cobra obfuscator]( http://obfuscator.uk/example/ )
34* [phpencode]( http://phpencode.org ) 36* [phpencode]( http://phpencode.org )
35* [webtoolsvn]( http://www.webtoolsvn.com/en-decode/ )
36* [tennc]( http://tennc.github.io/webshell/ ) 37* [tennc]( http://tennc.github.io/webshell/ )
37* [web-malware-collection]( https://github.com/nikicat/web-malware-collection ) 38* [web-malware-collection]( https://github.com/nikicat/web-malware-collection )
38* [P.A.S]( http://profexer.name/pas/download.php ) 39* [webtoolsvn]( http://www.webtoolsvn.com/en-decode/ )
39 40
40 41
41Of course it's **trivial** to bypass PMF, 42Of course it's **trivial** to bypass PMF,
@@ -43,7 +44,7 @@ but its goal is to catch kiddies and idiots,
43not people with a working brain. 44not people with a working brain.
44 45
45If you report a stupid tailored bypass for PMF, you likely belong to one (or 46If you report a stupid tailored bypass for PMF, you likely belong to one (or
46both) category, and should re-read the previous sentence. 47both) category, and should re-read the previous statement.
47 48
48## How does it work? 49## How does it work?
49 50
@@ -83,7 +84,7 @@ whitelist system, and greedy regexps. Please note that if you plan to build
83yara from sources, libssl-dev must be installed on your system in order to 84yara from sources, libssl-dev must be installed on your system in order to
84have support for hashes. 85have support for hashes.
85 86
86Ho, and by the way, you can run the comprehensive testsuite with `make test`. 87Ho, and by the way, you can run the *comprehensive* testsuite with `make test`.
87 88
88## Whitelisting 89## Whitelisting
89 90
@@ -97,9 +98,9 @@ Because:
97 https://github.com/Neo23x0/signature-base/blob/e264d66a8ea3be93db8482ab3d639a2ed3e9c949/yara/thor-webshells.yar 98 https://github.com/Neo23x0/signature-base/blob/e264d66a8ea3be93db8482ab3d639a2ed3e9c949/yara/thor-webshells.yar
98 ), since it only cares about finding malicious patterns, not specific webshells 99 ), since it only cares about finding malicious patterns, not specific webshells
99- Its whitelist system doesn't rely on filenames 100- Its whitelist system doesn't rely on filenames
100- It doesn't rely on (slow) entropy calculation 101- It doesn't rely on (slow) [entropy computation]( https://en.wikipedia.org/wiki/Entropy_(information_theory) )
101- It uses a ghetto-style static analysis, instead of relying on file hashes 102- It uses a ghetto-style static analysis, instead of relying on file hashes
102- Thanks to the aforementioned pseudo-static analysis, it works on obfuscated files too 103- Thanks to the aforementioned pseudo-static analysis, it works (especially) on obfuscated files too
103 104
104## Licensing 105## Licensing
105 106