Stars: 493
Forks: 117
Pull Requests: 47
Issues: 46
Watchers: 25
Last Updated: 2023-06-19 01:59:05
AMWScan (PHP Antimalware Scanner) is a free tool to scan php files and analyze your project to find any malicious code inside it.
License: GNU General Public License v3.0
Languages: PHP, Shell, Dockerfile, HTML
PHP Antimalware Scanner is a free tool to scan PHP files and analyze your project to find any malicious code inside it.
It provides an interactive text terminal console interface to scan a file, or all files in a given directory (file paths
can also be managed using --filter-paths
or --ignore-paths
), and find PHP code files that seem to contain malicious
code. When a probable malware is detected, will be asked what action to take (like add to the whitelist, delete files, try
clean infected code, etc).
The package can also scan the PHP files in a report mode (--report|-r
), so without interacting and outputting anything to
the terminal console. In that case, the results will be stored in a report file in HTML (default) or text
format (--report-format <format>
).
This scanner can work on your own php projects and on a lot of other platforms using the right combination of
configurations (ex. using --lite|-l
flag can help to find less false positivity).
Have an idea? Found a bug? Please raise to ISSUES or PULL REQUEST. Contributions are welcome and are greatly appreciated! Every little bit helps.
You can use one of these methods to install the scanner by downloading it from GitHub or directly from the console.
Go to the GitHub page and press on the Releases tab or download the raw file from:
Run this command from the console (the scanner will be downloaded to your current directory):
wget https://raw.githubusercontent.com/marcocesarato/PHP-Antimalware-Scanner/master/dist/scanner
Run the scanner:
php scanner ./dir-to-scan -l ...
(Optional) Install as bin command (Unix Bash)
Run this command:
wget https://raw.githubusercontent.com/marcocesarato/PHP-Antimalware-Scanner/master/dist/scanner -O /usr/bin/awscan.phar && \
printf "#!/bin/bash\nphp /usr/bin/awscan.phar \$@" > /usr/bin/awscan && \
chmod u+x,g+x /usr/bin/awscan.phar && \
chmod u+x,g+x /usr/bin/awscan && \
export PATH=$PATH":/usr/bin"
Now you can run the scanner simply with this command: awscan ./dir-to-scan -l...
Click the GitHub page "Clone or download" or download from:
git clone https://github.com/marcocesarato/PHP-Antimalware-Scanner
~/PHP-Antimalware-Scanner
directory:
cd ~/PHP-Antimalware-Scanner/
git pull https://github.com/marcocesarato/PHP-Antimalware-Scanner
docker build --tag amwscan-docker .
docker run -it --rm amwscan-docker bash
The first think you need to decide is the strength, you need to calibrate your scan to find less false positive as possible during scanning without miss for real malware. For this you can choose the aggression level.
The scanner permit to have some predefined modes:
Mode | Alias | 🚀 | Description |
---|---|---|---|
None (default) | 🔴 | Search for all functions, exploits and malware signs without any restrictions | |
Only exploits | -e |
🟠 | Search only for exploits definitions Use flag: --only-exploits |
Lite mode | -l |
🟡 | Search for exploits with some restrictions and malware signs (on Wordpress and others platform could detect less false positivity) Use flag: --lite |
Only functions | -f |
🟡 | Search only for functions (on some obfuscated code functions couldn't be detected) Use flag: --only-functions |
Only signatures | -s |
🟢 | Search only for malware signatures (could be a good solution for Wordpress and others platform to detect less false positivity) Use flag: --only-signatures |
php amwscan ./mywebsite/http/ -l -s --only-exploits
php amwscan -s --max-filesize="5MB"
php amwscan -s -logs="/user/marco/scanner.log"
php amwscan --lite --only-exploits
php amwscan --exploits="double_var2" --functions="eval, str_replace"
php amwscan --ignore-paths="/my/path/*.log,/my/path/*/cache/*"
To check all options check the Documentation
If you are running the scanner on a Wordpress project or other popular platform use --only-signatures
or --lite
flag
to have check with less false positive but this could miss some dangerous exploits like nano
.
On programmatically silent mode and auto skip are automatically enabled.
use AMWScan\Scanner;
$app = new Scanner();
$report = $app->setPathScan("my/path/to/scan")
->enableBackups()
->setPathBackups("/my/path/backups")
->enableLiteMode()
->setAutoClean()
->run();
object(stdClass) (7) {
["scanned"] => int(0)
["detected"] => int(0)
["removed"] => array(0) {}
["ignored"] => array(0) {}
["edited"] => array(0) {}
["quarantine"] => array(0) {}
["whitelist"] => array(0) {}
}
HTML report format (
default
)