diff --git a/patterns_re.txt b/patterns_re.txt index f0b53f6..6700d6e 100644 --- a/patterns_re.txt +++ b/patterns_re.txt @@ -1,3 +1,7 @@ +#PHP Regular Expressions +#All comment lines must have '#' as the first character of the line. +#More critical rules should be put higher in the list as only the first pattern matched is reported to the user. + eval\/\*[a-z0-9]+\*\/ eval\([a-z0-9]{4,}\(\$[a-z0-9]{4,}, \$[0-9a-z]{4,}\)\); (chr\(\d+\)\.){4,} @@ -15,4 +19,8 @@ if\s*\(\s*mail\s*\(\s*\$mails\[\$i\]\s*,\s*\$tema\s*,\s*base64_encode\s*\(\s*\$t fwrite\s*\(\s*\$fh\s*,\s*stripslashes\s*\(\s*@*\$_(GET|POST|SERVER|COOKIE|REQUEST)\[ echo\s+file_get_contents\s*\(\s*base64_url_decode\s*\(\s*@*\$_(GET|POST|SERVER|COOKIE|REQUEST) chr\s*\(\s*101\s*\)\s*\.\s*chr\s*\(\s*118\s*\)\s*\.\s*chr\s*\(\s*97\s*\)\s*\.\s*chr\s*\(\s*108\s*\) -(\$OOO_O_000_\{\d+\}.){3,} \ No newline at end of file +(\$OOO_O_000_\{\d+\}.){3,} + +#Detects generic base64 strings longer than 260 characters enclosed in quotes ending with 0-3 '=' chars. +#260 was a threshold chosen because strings of 256 characters are common enough. Might increase later to reduce false positives. +['"][A-Za-z0-9+\/]{260,}={0,3}['"]