5

Some weeks ago 2 of my sites have been exploited probably from an ftp bruteforce attack corrupting lots of my websites files. I found out that they usually insert the following code in js or php files:

[Trojan code removed as irrelevant to this question.]

I want to login via ssh and run a grep command searching all files and giving output only for the ones that have this code included.

Any help?

Robert Cartaino
  • 27,494
  • 6
  • 45
  • 67
makmour
  • 2,099
  • 3
  • 16
  • 12

3 Answers3

15

I use this command to find all files that contain a specified string:

find /path/ -name "*.ext" -exec grep -l "sting" {} \;
Chadwick
  • 12,555
  • 7
  • 49
  • 66
Bdwey
  • 1,813
  • 1
  • 16
  • 18
5

After you log in, just run: 

find /path/to/fies -type f -name "*.js" -exec grep -il 'string' {}\; > output.txt

replacing "/path/to/files" and 'string' as appropriate, of course.

Dmitri
  • 2,658
  • 2
  • 25
  • 41
2

Use find to narrow by extension and grep to look inside each file. Adding -r and -I to your grep will search recursively and ignore binary (e.g. git) files. 

find ./ -name "*.php" -exec grep -r -l -I "Layer" {} \;
ow3n
  • 5,974
  • 4
  • 53
  • 51