Script for searching all .php files for evidence of PHP injections

injectionscan.sh

#!/bin/sh
#
# Author: Peter Toi
# Source: https://gist.github.com/petertoi/23d072d1d8589d9f5386
#
# Usage 1: $ injectionscan.sh

rm -fr injections.txt
touch injections.txt

find . -type f -name '*.php' -print0 |
  while read -r -d $'\0' x; do
  
    # Check first line of file for more than 20000 characters
    B=$(head -1 "$x")
    C=$(echo $B | wc -c)
    if [ "$C" -ge "20000" ]; then
      echo "Possible Injection: "$x $C
      echo $x $C >> injections.txt
    fi
    
    # Look for ('$_', pattern
    D=$(grep -n "('\$_'," "$x")
    if [ -n "$D" ]; then
      echo "Mid-File Injection: "$x:$D
      echo $x:$D >> injections.txt
    fi
    
  done