From 8c6c048eecb1bb4d74002e939d81df13321273e6 Mon Sep 17 00:00:00 2001 From: jvoisin Date: Tue, 11 Feb 2020 12:19:42 +0000 Subject: Fix some links in the readme --- README.md | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) (limited to 'README.md') diff --git a/README.md b/README.md index eb085b8..deb7352 100644 --- a/README.md +++ b/README.md @@ -50,7 +50,7 @@ both) category, and should re-read the previous statement. ## How does it work? Detection is performed by crawling the filesystem and testing files against a -[set](https://github.com/nbs-system/php-malware-finder/blob/master/php-malware-finder/php.yar) +[set](https://github.com/jvoisin/php-malware-finder/blob/master/php-malware-finder/php.yar) of [YARA](http://virustotal.github.io/yara/) rules. Yes, it's that simple! Instead of using an *hash-based* approach, @@ -73,7 +73,7 @@ YACC=bison ./configure make ``` -- Download php-malware-finder `git clone https://github.com/nbs-system/php-malware-finder.git` +- Download php-malware-finder `git clone https://github.com/jvoisin/php-malware-finder.git` ## How to use it? @@ -103,9 +103,9 @@ Oh, and by the way, you can run the *comprehensive* testsuite with `make tests`. ## Whitelisting -Check the [whitelist.yar](https://github.com/nbs-system/php-malware-finder/blob/master/php-malware-finder/whitelist.yar) file. +Check the [whitelist.yar](https://github.com/jvoisin/php-malware-finder/blob/master/php-malware-finder/whitelist.yar) file. If you're lazy, you can generate whitelists for entire folders with the -[generate_whitelist.py](https://github.com/nbs-system/php-malware-finder/blob/master/php-malware-finder/utils/generate_whitelist.py) script. +[generate_whitelist.py](https://github.com/jvoisin/php-malware-finder/blob/master/php-malware-finder/utils/generate_whitelist.py) script. ## Why should I use it instead of something else? @@ -113,7 +113,7 @@ Because: - It doesn't use [a single rule per sample]( https://github.com/Neo23x0/signature-base/blob/e264d66a8ea3be93db8482ab3d639a2ed3e9c949/yara/thor-webshells.yar ), since it only cares about finding malicious patterns, not specific webshells -- It has a [complete testsuite](https://travis-ci.org/nbs-system/php-malware-finder), to avoid regressions +- It has a [complete testsuite](https://travis-ci.org/jvoisin/php-malware-finder), to avoid regressions - Its whitelist system doesn't rely on filenames - It doesn't rely on (slow) [entropy computation]( https://en.wikipedia.org/wiki/Entropy_(information_theory) ) - It uses a ghetto-style static analysis, instead of relying on file hashes @@ -122,7 +122,7 @@ Because: ## Licensing PHP-malware-finder is -[licensed](https://github.com/nbs-system/php-malware-finder/blob/master/php-malware-finder/LICENSE) +[licensed](https://github.com/jvoisin/php-malware-finder/blob/master/php-malware-finder/LICENSE) under the GNU Lesser General Public License v3. The _amazing_ YARA project is licensed under the Apache v2.0 license. -- cgit v1.3