Hacking Articles Tips Tricks Videos Tutorials

Php-Malware-Finder - Detect Potentially Malicious PHP Files

PHP-malware-finder does its very best to detect obfuscated/dodgy code as well as files using PHP functions often used in malwares/webshells. The following list of encoders/obfuscators/webshells are also detected: Bantam Best PHP Obfuscator Carbylamine Cipher Design Cyklodev Joes Web Tools Obfuscator P.A.S PHP Jiami Php Obfuscator Encode SpinObf Weevely3 atomiku cobra obfuscator nano novahot phpencode tennc web-malware-collection webtoolsvn Of course it's trivial to bypass PMF, but its goal is to catch kiddies and idiots, not people with a working brain. If you report a stupid tailored bypass for PMF, you likely belong to one (or both) category, and should re-read the previous statement. How does it work? Detection is performed by crawling the filesystem and testing files against a set of YARA rules. Yes, it's that simple! Instead of using an hash-based approach, PMF tries as much as possible to use semantic patterns, to detect things like "a $_GET variable is decoded two times, unzipped, and then passed to some dangerous function like system". Installation Install Yara. This is also possible via some Linux package managers: Debian: sudo apt-get install yara Red Hat: yum install yara (requires the EPEL repository) You can also compile it from source: git clone git@github.com:VirusTotal/yara.gitcd yara/YACC=bison ./configuremake Download php-malware-finder git clone https://github.com/jvoisin/php-malware-finder.git How to use it? $ ./phpmalwarefinder -hUsage phpmalwarefinder -cfhtvl ... -c Optional path to a rule file -f Fast mode -h Show this help message -t Specify the number of threads to use (8 by default) -v Verbose mode Or if you prefer to use yara: $ yara -r ./php.yar /var/www Please keep in mind that you should use at least YARA 3.4 because we're using hashes for the whitelist system, and greedy regexps. Please note that if you plan to build yara from sources, libssl-dev must be installed on your system in order to have support for hashes. Oh, and by the way, you can run the comprehensive testsuite with make tests. Whitelisting Check the whitelist.yar file. If you're lazy, you can generate whitelists for entire folders with the generate_whitelist.py script. Why should I use it instead of something else? Because: It doesn't use a single rule per sample, since it only cares about finding malicious patterns, not specific webshells It has a complete testsuite, to avoid regressions Its whitelist system doesn't rely on filenames It doesn't rely on (slow) entropy computation It uses a ghetto-style static analysis, instead of relying on file hashes Thanks to the aforementioned pseudo-static analysis, it works (especially) well on obfuscated files Licensing PHP-malware-finder is licensed under the GNU Lesser General Public License v3. The amazing YARA project is licensed under the Apache v2.0 license. Patches, whitelists or samples are of course more than welcome. Download Php-Malware-Finder
Read more...

___________________________
@hacking_Attack
@Hacking_Video

GitHub

GitHub - jvoisin/php-malware-finder: Detect potentially malicious PHP files

Detect potentially malicious PHP files. Contribute to jvoisin/php-malware-finder development by creating an account on GitHub.

10 viewsedited 20:50

Hacking Articles Tips Tricks Videos Tutorials

9 views21:29

Hacking Articles Tips Tricks Videos Tutorials

Photo

Dark Reading: Attacks/Breaches
Titaniam Secures $6 Million in Seed Funding

Funding round led by Refinery Ventures, with participation from Fusion Fund and Shasta Ventures.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading

Titaniam Secures $6 Million in Seed Funding

Funding round led by Refinery Ventures, with participation from Fusion Fund and Shasta Ventures.

9 viewsedited 21:29

Hacking Articles Tips Tricks Videos Tutorials

9 views21:29

Hacking Articles Tips Tricks Videos Tutorials

Photo

Dark Reading: Attacks/Breaches
Allure Security Raises $6.8 Million Seed Funding Round

Funding led by Gutbrain Ventures.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading

Allure Security Raises $6.8 Million Seed Funding Round

Funding led by Gutbrain Ventures.

9 viewsedited 21:29

Hacking Articles Tips Tricks Videos Tutorials

9 views21:29

Hacking Articles Tips Tricks Videos Tutorials

Photo

Dark Reading: Attacks/Breaches
Orca Security Adds Expanded CIEM Capabilities and Multi-Cloud Security Score to Cloud Platform

Expands cloud infrastructure entitlement management capabilities, adds cloud security benchmarking, and support for Kubernetes compliance frameworks.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading

Orca Security Adds Expanded CIEM Capabilities and Multi-Cloud Security Score to Cloud Platform

Expands cloud infrastructure entitlement management capabilities, adds cloud security benchmarking, and support for Kubernetes compliance frameworks.

10 viewsedited 21:29

Hacking Articles Tips Tricks Videos Tutorials

9 views21:29

Hacking Articles Tips Tricks Videos Tutorials

Dark Reading: Attacks/Breaches
Defense Contractors Need to Check Their Six

Companies overall met government standards, but poor credential management left vulnerabilities.

10 views21:29

Source

Hacking Articles Tips Tricks Videos Tutorials

Photo

Dark Reading: Attacks/Breaches
Dynatrace Launches DevSecOps Automation Alliance Partner Program

Program enables alliance and solution partners to extend the capabilities of their DevSecOps offerings through seamless integrations with the Dynatrace platform.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading

Dynatrace Launches DevSecOps Automation Alliance Partner Program

Program enables alliance and solution partners to extend the capabilities of their DevSecOps offerings through seamless integrations with the Dynatrace platform.

10 viewsedited 21:29

Hacking Articles Tips Tricks Videos Tutorials

10 views21:29

Hacking Articles Tips Tricks Videos Tutorials

Photo

Dark Reading: Attacks/Breaches
Dynatrace Adds Real-Time Attack Detection and Blocking, Advancing Cloud Application Security

Application Security Module unifies multicloud observability and advanced AIOps with real-time vulnerability management and defense.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading

Dynatrace Adds Real-Time Attack Detection and Blocking, Advancing Cloud Application Security

Application Security Module unifies multicloud observability and advanced AIOps with real-time vulnerability management and defense.

12 viewsedited 21:29

Hacking Articles Tips Tricks Videos Tutorials

hacking: security in practice
Is it be illigal to take down illigal websites?

I would like really like to do this bacause I don't support illigal activities.

submitted by /u/PutYourNameHereNow
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Is it be illigal to take down illigal websites?

I would like really like to do this bacause I don't support illigal activities.

11 viewsedited 22:56

Hacking Articles Tips Tricks Videos Tutorials

10 views00:10

Hacking Articles Tips Tricks Videos Tutorials