Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'm automating a script which searches through all php files on a big site for dangerous commands. The files which are found will be manually code reviewed.

Does anyone have any recommendations for my script? Is there anything I've forgotten to search for? Please note that this script was put together in 10 minutes, so I'm sure there are a lot of improvements that can be done in order to make it easier and better (like multiple egrep arguments).

find . | grep "php$" | xargs grep -s "eval(" >> /tmp/review.txt
find . | grep "php$" | xargs grep -s "fopen(" >> /tmp/review.txt 
find . | grep "php$" | xargs grep -s "passthru(" >> /tmp/review.txt 
find . | grep "php$" | xargs grep -s "exec(" >> /tmp/review.txt 
find . | grep "php$" | xargs grep -s "proc_" >> /tmp/review.txt 
find . | grep "php$" | xargs grep -s "dl(" >> /tmp/review.txt 
find . | grep "php$" | xargs grep -s "require($" >> /tmp/review.txt
find . | grep "php$" | xargs grep -s "require_once($" >> /tmp/review.txt
find . | grep "php$" | xargs grep -s "include($" >> /tmp/review.txt 
find . | grep "php$" | xargs grep -s "include_once($" >> /tmp/review.txt 
find . | grep "php$" | xargs grep -s "include($" >> /tmp/review.txt 
find . | grep "php$" | xargs grep -s "query(" >> /tmp/review.txt 
share|improve this question
Are you doing a review of code developed in-house, or on a hosted environment? –  Scott Pack Dec 10 '10 at 14:22
Hmmm, I thought ChrisAD wants to find dangerous scripts or backdoors in his site, am I right? If this topic is about code review, then it should be edited and then that's completely another story. –  anonymous Dec 10 '10 at 14:34
Yes. Sorry for the misunderstanding, but this is about a quick and dirty code review –  Chris Andrè Dale Dec 10 '10 at 15:12
add comment

5 Answers

up vote 8 down vote accepted

Definitely this list is not enough. First of all, it is not complete, secondly, different obfuscation methods can be used to hide web-shells, other malicious scripts.

For such purposes long time ago I have written my own PHP-script to look for dangerous places: http://0x416d73.name/proj/fcc.html. It is written on PHP, so don't expect it to be as fast as "find" command. Though, it allows to check file hashes, view which files have appeared, are missing or has changed. I advise you to test it first against some small script, just to feel how it works, before running on production server. Also, specifically for search for vulnerabilities in PHP code, some time ago I have put together some easy bash script - http://privatepaste.com/88a5d5eaa3. It is not complete, might require tuning and criticism from bash guru's :)

If you want to continue on your own script, here is nice list from which you can extract what you need: http://privatepaste.com/dc335ccb86.

Updated: as it figured out, topic is about code review. Above mentioned solutions still makes sense, but then I would like to mention this one project: http://sourceforge.net/projects/rips-scanner/. To my mind, currently it is the best freely available source code analyzer for PHP web applications.

share|improve this answer
All but the last link in this post are gone. I would recommend Scott Pack's post over anything said in this one. –  sholsinger Jul 31 '12 at 13:10
add comment

While I do not have direct experience using static analysis tools on PHP, it looks like there are a number of tools, both open source and commercial, available for use.

Briefly, it looks like PHPLint should be fairly quick and easy to use. My interpretation indicates that it operates pretty similarly to lint/splint for C, which I have used and was pleased with.



share|improve this answer
+1 for mentioning Sonar, it's an awesome tool that works for many languages. –  bakoyaro Dec 11 '10 at 4:32
add comment

I'm not a PHP whiz, so I dont have much to add in the way of additional things to look for, but you should note that any kind of random whitespace will mess up your findings.

fopen  ( 

won't be found...

share|improve this answer
Very good point Avid. I double checked in some of the code, and some places there is space between function name and the bracket. –  Chris Andrè Dale Dec 13 '10 at 7:52
You definitely should NOT be doing this with grep. You should use an actual PHP tokenizer, not a pattern match. (PHP Code Sniffer operates on the token stream, not the source code.) –  mehaase Jan 18 '12 at 13:31
Oh, I agree. That was kind of my point, subtle as it was... –  AviD Jan 18 '12 at 20:49
add comment

I think extract is also a dangerous language construct. (Although it's more rarely used than eval(), so not many people realize it.)

You can also try using Php Code Sniffer and writing these as your own 'sniffs'. Here's one I wrote for an open source project I work on.

share|improve this answer
add comment

..so i have done a short script in perl which searches a given directory recursively for in the array "@dangercalls" given strings. for demonstration purpouses i have filled the array "@dangercalls" with common insecure considered php calls.

check it out:

pastie, cause the \code/ quoting won't show my code correct:


email me if the link disappears: jasper[antispam]reichardt[antispam]AT[antispam]gmail[antispam].com

share|improve this answer
add comment

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.