diff --git a/definitions/patterns_re.txt b/definitions/patterns_re.txt index 0f86264..40d4f6a 100644 --- a/definitions/patterns_re.txt +++ b/definitions/patterns_re.txt @@ -77,4 +77,13 @@ chr\s*\(\s*['"]?\s*((95)|(0[Xx]5[Ff]))\s*['"]?\s*\) \/\*[a-z0-9]{5}\*\/ # XOR-ed strings with custom math -%\(\d+\-\d+\+\d+\)==\(\-\d+\+\d+\+\d+\) \ No newline at end of file +%\(\d+\-\d+\+\d+\)==\(\-\d+\+\d+\+\d+\) + +# eval code from POST on second nested level +eval\(\$[a-z0-9_]+\(\$_POST + +# characted concated with chr() alteast 3 times +("[a-z0-9]+"\.chr\(\d+\)\.){3,} + +# nested function call used variables +\$[a-z]+\(\$[a-z0-9]+\( \ No newline at end of file