Scanning for PHP malware backdoors
Every Wordpress bod is going to encounter some malware or security issues. Here are some common tricks to find the backdoor.
Find common backdoors
</>grep -ri "eval" [path]
</>grep -ri "base64_decode" [path]
Find recently modified files
</>find -type f -ctime -0 | more
The -type looks for files, and -ctime restricts your scan to the last 24 hours. You can look at the last 24 or 48 hours by specifying -1 or -2, respectively.
Find PHP files in uploads (for wordpress)
</>find uploads -name "*.php" -print
Written by Derry Birkett
Related protips
1 Response
Thanks for this useful code. However, I think we can also rely on some security plugins like Security Ninja, All In One WP Security & Firewall, Wordfence Security, etc.to protect the website from various malware attacks. By the way, I will try using this code on my website.
Have a fresh tip? Share with Coderwall community!
Most application security programs still stop at the repository. The page a visitor loads can run third-party scripts that read the DOM, change a checkout, or steal a session after the deploy already looks clean.
Security insights from Cside