From 3b8dff160b11cd15389d041a7d164da668207af2 Mon Sep 17 00:00:00 2001 From: nichogenius Date: Tue, 15 Aug 2017 23:51:37 -0600 Subject: [PATCH] Added Experimental Patterns Removed anyresults.net from the base64 pattern strings. Added base64 patterns for $_POST $_GET $_REQUEST $_COOKIE extract and GLOBALS --- patterns_raw.txt | 33 +++++++++++++++++++++++++++++---- 1 file changed, 29 insertions(+), 4 deletions(-) diff --git a/patterns_raw.txt b/patterns_raw.txt index 848569f..410da0d 100644 --- a/patterns_raw.txt +++ b/patterns_raw.txt @@ -132,10 +132,35 @@ Y3NsYXNoZX NzbGFzaGVz jc2xhc2hlc -# "anyresults.net" in base64 ... this one may be too specific ? -YW55cmVzdWx0cy5uZX -FueXJlc3VsdHMubmV0 -hbnlyZXN1bHRzLm5ld +# "extract" in base64 +ZXh0cmFjd +V4dHJhY3 +leHRyYWN0 + +# "$_GET" in base64 +JF9HRV +RfR0VU +kX0dFV + +# "$_POST" in base64 +JF9QT1NU +RfUE9TV +kX1BPU1 + +# "$_COOKIE" in base64 +JF9DT09LSU +RfQ09PS0lF +kX0NPT0tJR + +# "$_REQUEST" in base64 +JF9SRVFVRVNU +RfUkVRVUVTV +kX1JFUVVFU1 + +# "GLOBALS" in base64 +R0xPQkFMU +dMT0JBTF +HTE9CQUxT # Obfuscation related code eval("?>