Work:Rogers SecurityScan Script
From Zoelife4U Wiki
Mr Roger has put together a nice script to scan websites for vulnerabilities. Below are the two versions available. These are up to date with the June 2nd edition.
PHP
Install this into public_html/ as secscan.php and run from a web browser.
<?php // This code is licensed under the GPL Version 2.0 only // Make sure you name the file with the .php extension // or one that is run as php. // This is Version 1.0 echo "<html><head><title>Security Scanner</title>"; echo "<!-- This code is licensed under the GPL Version 2.0 only --></head><body>"; echo '<p>'; echo 'Suspicious files in /tmp:'; echo '<br><pre>'; system("ls -al /tmp/ | grep `whoami` | grep -v sess_"); echo '</pre></p><p>'; echo 'World-writable files and folders:'; echo '<br><pre>'; system("find ./ -perm +og+w -follow"); echo '</pre></p><p>'; echo 'Broken symlinks:'; echo '<br><pre>'; system("for i in `find ./ -type l`; do [ -e $i ] || echo $i is broken; done"); echo '</pre></p><p>'; echo 'php.ini files with register_globals enabled:'; echo '<br><pre>'; system("find ./ -name php.ini -exec grep -Hli '^register_globals.*=.*On' {} \;"); echo '</pre></p><p>'; echo "Note: Speaking of cron jobs, you'll need to check those manually"; echo '<br>'; echo 'Running processes:'; echo '<br><pre>'; system("ps -eo pid,user,cmd | grep `whoami`"); echo "</pre></p></body></html>"; ?>
Bash
Put this into the $HOME directory, chmod it to 755 and run it from an SSH prompt.
#!/bin/sh cd ~ echo echo 'Suspicious files in /tmp:' ls -al /tmp/ | grep `whoami` | grep -v sess_ echo echo 'Suspicious files in /dev/shm:' echo "Note: If run as cron job, won't find any here anyway." ls -al /dev/shm/ | grep `whoami` echo echo 'World-writable files and folders:' find ~/public_html/ -perm +og+w -follow echo echo 'Broken symlinks:' for i in `find ~/public_html/ -type l`; do [ -e $i ] || echo $i is broken; done echo echo 'php.ini files with register_globals enabled:' find ~/public_html/ -name php.ini -exec grep -Hli '^register_globals.*=.*On' {} \; echo echo 'Available backups:' echo "Note: If run as cron job, won't find any here anyway." ls -ld /home/`whoami`.* echo echo "Note: Speaking of cron jobs, you'll need to check those manually" echo echo 'Running processes:' ps -eo pid,user,cmd | grep `whoami`
