cylab-be/webshell-detector

Webshell detector

1.0.2 2018-03-12 04:18 UTC

Requires

• symfony/console: ^3
• symfony/finder: ^3.4
• webd/language: dev-master

Requires (Dev)

• kherge/box: ^2.7
• phpunit/phpunit: ^6.2
• squizlabs/php_codesniffer: *

MIT

• Enzo Borel
• Thibault Debatty

README

Developement now taks place at https://gitlab.cylab.be/cylab/webshell-detector

Installation and usage

The webshell detector can be integrated as a composer library to your project, or you can run it from the command line.

As a library

composer require cylab-be/webshell-detector

require_once "vendor/autoload.php";

use RUCD\WebshellDetector\Detector;

$detector = new Detector();
echo $detector->analyzeFile("strange_file.php");

From the command line

Download the runnable PHAR from the Releases pages.

To run:

webshell-detector.phar analyze:directory /path/to/directory

You can modify the "sensitivity" of the detector, by modifying the threshold for displaying files. This will display the suspiciousness score of every files:

webshell-detector.phar analyze:directory -t 0.0 /path/to/directory

The default threshold used by the tool is 0.4