https://github.com/cvar1984/sussyfinder

Single file php webshell scanner to detect potentially malicious backdoor based on token and hash with web interface and VirusTotal integration
https://github.com/cvar1984/sussyfinder

antivirus backdoor forensics hacktoberfest malware malware-analysis php webshells

Last synced: 6 months ago
JSON representation

Single file php webshell scanner to detect potentially malicious backdoor based on token and hash with web interface and VirusTotal integration

• Host: GitHub
• URL: https://github.com/cvar1984/sussyfinder
• Owner: Cvar1984
• License: gpl-3.0
• Created: 2023-06-02T10:23:44.000Z (about 3 years ago)
• Default Branch: main
• Last Pushed: 2024-10-22T07:54:52.000Z (almost 2 years ago)
• Last Synced: 2024-10-23T11:21:50.424Z (over 1 year ago)
• Topics: antivirus, backdoor, forensics, hacktoberfest, malware, malware-analysis, php, webshells
• Language: PHP
• Homepage:
• Size: 746 KB
• Stars: 61
• Watchers: 2
• Forks: 11
• Open Issues: 0
• Metadata Files:
  • Readme: README.md
  • Contributing: CONTRIBUTING.md
  • License: LICENSE
  • Code of conduct: CODE_OF_CONDUCT.md

Awesome Lists containing this project

README

          
# SussyFinder

[![CodeFactor](https://www.codefactor.io/repository/github/cvar1984/sussyfinder/badge)](https://www.codefactor.io/repository/github/cvar1984/sussyfinder)

[![PRs Welcome](https://img.shields.io/badge/PRs-welcome-brightgreen.svg?style=flat-square)](https://makeapullrequest.com)

PHP web application that scans a directory for files with specific extensions (e.g., PHP scripts) and checks for suspicious tokens or patterns within the files.

The application uses various PHP functions and techniques to achieve this, including recursive directory scanning, file token extraction, and token comparison.

This tool is designed to help identify potentially malicious PHP files in a web server environment, but it should be used with caution as it may produce false positives and has the capability to delete files.

## Requirements

- PHP4/PHP5/PHP7/PHP8

- VirusTotal APIKey (Optional)

## Features

- token based comparison (ignore some obfuscation technique)

- support "" and "<%" notations

- md5 hash based comparison (whitelist & blacklist)

- recent times sorted result

- highlight result by color

- copy paste result

![ss](https://raw.githubusercontent.com/Cvar1984/sussyfinder/main/demo.jpg)

![profile](https://raw.githubusercontent.com/Cvar1984/sussyfinder/main/profile.png)

>clone webshells submodule for testing

## Whitelist & blacklist

Whitelist system exist to skip the program from scanning whitelisted files to speed up the whole thing.

Whitelist hash i provide is harvested from common frameworks and libraries, its up to you to trust it or no.

Blacklist system exist also to speed up the scanning progress and make it easier to spot the malware.

please provide the source files if you want to make pr to add your own hash data.