mirror of
https://github.com/scr34m/php-malware-scanner.git
synced 2026-06-16 12:30:35 +00:00
Fix for #12
This commit is contained in:
@@ -78,3 +78,12 @@ chr\s*\(\s*['"]?\s*((95)|(0[Xx]5[Ff]))\s*['"]?\s*\)
|
|||||||
|
|
||||||
# XOR-ed strings with custom math
|
# XOR-ed strings with custom math
|
||||||
%\(\d+\-\d+\+\d+\)==\(\-\d+\+\d+\+\d+\)
|
%\(\d+\-\d+\+\d+\)==\(\-\d+\+\d+\+\d+\)
|
||||||
|
|
||||||
|
# eval code from POST on second nested level
|
||||||
|
eval\(\$[a-z0-9_]+\(\$_POST
|
||||||
|
|
||||||
|
# characted concated with chr() alteast 3 times
|
||||||
|
("[a-z0-9]+"\.chr\(\d+\)\.){3,}
|
||||||
|
|
||||||
|
# nested function call used variables
|
||||||
|
\$[a-z]+\(\$[a-z0-9]+\(
|
||||||
Reference in New Issue
Block a user