cylab-be/webshell-detector

Webshell detector

webshell-detector

, _(*1)

Developement now taks place at https://gitlab.cylab.be/cylab/webshell-detector, _(*2)

Installation and usage

The webshell detector can be integrated as a composer library to your project, or you can run it from the command line., _(*3)

As a library

composer require cylab-be/webshell-detector, _(*4)

require_once "vendor/autoload.php";

use RUCD\WebshellDetector\Detector;

$detector = new Detector();
echo $detector->analyzeFile("strange_file.php");

From the command line

Download the runnable PHAR from the Releases pages., _(*5)

To run:, _(*6)

webshell-detector.phar analyze:directory /path/to/directory

, _(*7)

You can modify the "sensitivity" of the detector, by modifying the threshold for displaying files. This will display the suspiciousness score of every files:, _(*8)

webshell-detector.phar analyze:directory -t 0.0 /path/to/directory

The default threshold used by the tool is 0.4, _(*9)