From 692db78fed2beae3f8fee2de350df678052228b1 Mon Sep 17 00:00:00 2001 From: jvoisin Date: Tue, 5 Jan 2016 14:11:54 +0100 Subject: Update the documentation --- README.md | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index 9e8abd6..6bb566b 100644 --- a/README.md +++ b/README.md @@ -14,7 +14,8 @@ Detect potentially malicious PHP files. ## What does it detect? -PHP-malware-finder does its very best to detect obfuscated/dodgy code as well as files using PHP functions often used in malwares/webshells. +PHP-malware-finder does its very best to detect obfuscated/dodgy code as well as +files using PHP functions often used in malwares/webshells. The following list of encoders/obfuscators/webshells are also detected: @@ -32,10 +33,13 @@ The following list of encoders/obfuscators/webshells are also detected: * [webtoolsvn]( http://www.webtoolsvn.com/en-decode/ ) * [tennc]( http://tennc.github.io/webshell/ ) +Of course it's easy to bypass PMF, but its goal is to catch kiddies and idiots, +not people with a working brain. ## How does it work? -Detection is performed by crawling the filesystem and testing files against a [set]( https://github.com/nbs-system/php-malware-finder/blob/master/malwares.yara ) +Detection is performed by crawling the filesystem and testing files against a +[set]( https://github.com/nbs-system/php-malware-finder/blob/master/malwares.yara ) of [YARA](https://plusvic.github.io/yara/) rules. Yes, it's that simple! @@ -47,6 +51,7 @@ Usage phpmalwarefinder [-cfhw] ... -c Optional path to a configuration file -f Fast mode -h Show this help message + -t Specify the number of threads to use (8 by default) -v Verbose mode ``` @@ -59,7 +64,8 @@ $ yara -r ./malwares.yara /var/www ## Whitelisting Check the [whitelist.yara]( https://github.com/nbs-system/php-malware-finder/blob/master/whitelist.yara ) file. -If you're lazy, you can generate whitelists for entire folders with the [generate_whitelist.py]( https://github.com/nbs-system/php-malware-finder/blob/master/generate_whitelist.py ) script. +If you're lazy, you can generate whitelists for entire folders with the +[generate_whitelist.py]( https://github.com/nbs-system/php-malware-finder/blob/master/generate_whitelist.py ) script. ## Licensing -- cgit v1.3