External/php-malware-scanner
1
0
Fork 0
mirror of https://github.com/scr34m/php-malware-scanner.git synced 2026-06-16 12:30:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Added generic base64 long string pattern

Browse Source 
Added some comments to the file and added a generic base64 string regex for long base64 strings.
This commit is contained in:
nichogenius
2017-07-26 00:26:29 -06:00
committed by GitHub
parent 8122d11eff
commit b138ce1707
1 changed files with 9 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
patterns_re.txt
View File

@@ -1,3 +1,7 @@
#PHP Regular Expressions
#All comment lines must have '#' as the first character of the line.
#More critical rules should be put higher in the list as only the first pattern matched is reported to the user.
eval\/\*[a-z0-9]+\*\/ eval\/\*[a-z0-9]+\*\/
eval\([a-z0-9]{4,}\(\$[a-z0-9]{4,}, \$[0-9a-z]{4,}\)\); eval\([a-z0-9]{4,}\(\$[a-z0-9]{4,}, \$[0-9a-z]{4,}\)\);
(chr\(\d+\)\.){4,} (chr\(\d+\)\.){4,}
@@ -16,3 +20,7 @@ fwrite\s*\(\s*\$fh\s*,\s*stripslashes\s*\(\s*@*\$_(GET|POST|SERVER|COOKIE|REQUES
echo\s+file_get_contents\s*\(\s*base64_url_decode\s*\(\s*@*\$_(GET|POST|SERVER|COOKIE|REQUEST) echo\s+file_get_contents\s*\(\s*base64_url_decode\s*\(\s*@*\$_(GET|POST|SERVER|COOKIE|REQUEST)
chr\s*\(\s*101\s*\)\s*\.\s*chr\s*\(\s*118\s*\)\s*\.\s*chr\s*\(\s*97\s*\)\s*\.\s*chr\s*\(\s*108\s*\) chr\s*\(\s*101\s*\)\s*\.\s*chr\s*\(\s*118\s*\)\s*\.\s*chr\s*\(\s*97\s*\)\s*\.\s*chr\s*\(\s*108\s*\)
(\$OOO_O_000_\{\d+\}.){3,} (\$OOO_O_000_\{\d+\}.){3,}
#Detects generic base64 strings longer than 260 characters enclosed in quotes ending with 0-3 '=' chars.
#260 was a threshold chosen because strings of 256 characters are common enough. Might increase later to reduce false positives.
['"][A-Za-z0-9+\/]{260,}={0,3}['"]