diff options
| -rw-r--r-- | php-malware-finder/php.yar | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/php-malware-finder/php.yar b/php-malware-finder/php.yar index dad427b..ab63da5 100644 --- a/php-malware-finder/php.yar +++ b/php-malware-finder/php.yar | |||
| @@ -48,7 +48,7 @@ rule PasswordProtection | |||
| 48 | { | 48 | { |
| 49 | strings: | 49 | strings: |
| 50 | $md5 = /md5\s*\(\s*\$_(GET|REQUEST|POST|COOKIE)[^)]+\)\s*===?\s*['"][0-9a-f]{32}['"]/ nocase | 50 | $md5 = /md5\s*\(\s*\$_(GET|REQUEST|POST|COOKIE)[^)]+\)\s*===?\s*['"][0-9a-f]{32}['"]/ nocase |
| 51 | $sha1 = /sha1\s*\(\s*\$_(GET|REQUEST|POST|COOKIE)[^)]+\)\s*===?\s*['"][0-9a-f]{32}['"]/ nocase | 51 | $sha1 = /sha1\s*\(\s*\$_(GET|REQUEST|POST|COOKIE)[^)]+\)\s*===?\s*['"][0-9a-f]{40}['"]/ nocase |
| 52 | condition: | 52 | condition: |
| 53 | any of them | 53 | any of them |
| 54 | } | 54 | } |