Fortunately despite recently becoming a full time web developer, security is something I take very seriously. There's a developer that I work with who's system was recently compromised with obfuscated php (Frequently using eval()
and base64_decode()
). At first glance it looks like the script might fail due to a missing token but would like to evaluate this script myself.
What's the best way to do this? I had thought about using an online php parser, parsing it on my localhost, or setting up a lamp virtual box but need to verify that any one of these methods is safe or legal.