Skip to content

Instantly share code, notes, and snippets.

@hn-support

hn-support/content-scan.sh

Created June 1, 2017 10:00
Show Gist options
  • Save hn-support/e146a05d1d1f4fde1edeb1ed84b33e00 to your computer and use it in GitHub Desktop.
Save hn-support/e146a05d1d1f4fde1edeb1ed84b33e00 to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. hn-support created this gist Jun 1, 2017.
    3 changes: 3 additions & 0 deletions content-scan.sh
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,3 @@
    #!/bin/bash
    # Find files that contain suspicious php code
    grep -RE 'preg_replace\(|eval\(|base64_decode\(' --include='*.php' . | cut -d: -f 1 | sort -u | while read line ; do echo $line | cat - $line | less ; done
    6 changes: 6 additions & 0 deletions neo-scan.sh
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,6 @@
    #!/bin/bash
    # This script scans for rogue php files using neopi.py (https://github.com/Neohapsis/NeoPI)
    # To download neopi:
    # wget https://raw.githubusercontent.com/Neohapsis/NeoPI/master/neopi.py
    # chmod +x neopi.py
    ./neopi.py -aA . | awk {' print $2 '} | grep "\./" | sort | uniq -c | sort -nr | awk {' print $2 '} | while read line; do (echo $line;echo;cat $line)|less; done