Quarterbore
09-27-2008, 11:20 PM
I am looking for feedback of an idea I have been playing with but I have not had the time to start working on. If such a tool exists, please let me know as I would be interested in purchasing!
My idea is simply to have a script (php or even something else) that will look at all the folders and files on a server and scan the file for typical things that hackers add. The code would simply need to open the files on the server and scan the file for matches to a configurable list (base 64, hacker, other common things we see in hacker tools).
The script would then output the list to a log on the server in a line delineated format including a code for matches, file path/name, file size, date modified (anything else?). Also, I assume hacked files would show a modified date so we could likely only scan files changed since last scan too!
A second script would then be used to read the log file and put it into a database where the information can be reviewed by a site admin. The site admin could select actions such as "DELETE" or "IGNORE" after evaluation even if the admin had to go in via FTP and manually do the delete.
The next time the process is run, if a file in a path is previously marked IGNORE and the date is the same the code would not log the update so that the Admin only needs to evaluate changes!
So, does something like this exist?
What would be the best way to code something like this (PHP or some shell script or ???)?
Does this seem like too much of a server hog or something that could be done?
Oppinions?
My idea is simply to have a script (php or even something else) that will look at all the folders and files on a server and scan the file for typical things that hackers add. The code would simply need to open the files on the server and scan the file for matches to a configurable list (base 64, hacker, other common things we see in hacker tools).
The script would then output the list to a log on the server in a line delineated format including a code for matches, file path/name, file size, date modified (anything else?). Also, I assume hacked files would show a modified date so we could likely only scan files changed since last scan too!
A second script would then be used to read the log file and put it into a database where the information can be reviewed by a site admin. The site admin could select actions such as "DELETE" or "IGNORE" after evaluation even if the admin had to go in via FTP and manually do the delete.
The next time the process is run, if a file in a path is previously marked IGNORE and the date is the same the code would not log the update so that the Admin only needs to evaluate changes!
So, does something like this exist?
What would be the best way to code something like this (PHP or some shell script or ???)?
Does this seem like too much of a server hog or something that could be done?
Oppinions?