Skip to content

Instantly share code, notes, and snippets.

@bhowe

bhowe/shell-commands-to-look-for-wordpress-hacks

Last active August 29, 2015 14:01
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save bhowe/b730435f9656bd95ef66 to your computer and use it in GitHub Desktop.
Save bhowe/b730435f9656bd95ef66 to your computer and use it in GitHub Desktop.
Download ZIP
Common Shell commands to help track down Wordpress hacks
Raw
shell-commands-to-look-for-wordpress-hacks
Find common problems in wordpress hacks
Finds eval or base64 decode
grep -ri "eval" [path]
grep -ri "base64_decode" [path]
Recently modified files
find -type f -ctime -0 | more
The -type looks for files, and -ctime scans last 24 hours. Subtract days by number (-1 24 gours) or -2 (48 hours) , See man find for more info
Find PHP files in uploads directory
find uploads -name "*.php" -print
Find a string of hex digits
grep -rP “(?:\\\\x[A-F0-9]{2}){5}” *
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment