About 3 months ago, I used a free PHP app to host my website.
However, I recently unexpectedly found the PHP app contains a PHP web shell by accident.
I am so surprised, and want to know I should how to detect these PHP backdoors before using the php app.
Asked
Active
Viewed 6,935 times
0
Matt Elson
- 4,177
- 8
- 31
- 46
-
2There are people that train for years to be able to do this. I don't think this question can be reasonably answered here. – Jon Feb 23 '12 at 17:12
-
Don't download "free apps" unless they are actively developed open source projects with large user bases, and you can verify that you are downloading from the original source. – Michael Berkowski Feb 23 '12 at 17:12
-
Can you be a little more specific? – Jeremy Harris Feb 23 '12 at 17:12
-
Maybe try asking at: http://security.stackexchange.com/ – Mchl Feb 23 '12 at 17:19
-
Related: [PHP security scanner](http://stackoverflow.com/q/3056150/55075) – kenorb Jul 27 '16 at 00:28
2 Answers
4
You can use http://cirt.net/nikto2
Nikto is an Open Source (GPL) web server scanner which performs comprehensive tests against web servers for multiple items, including over 6400 potentially dangerous files/CGIs, checks for outdated versions of over 1200 servers, and version specific problems on over 270 servers. It also checks for server configuration items such as the presence of multiple index files, HTTP server options, and will attempt to identify installed web servers and software. Scan items and plugins are frequently updated and can be automatically updated.
rkosegi
- 14,165
- 5
- 50
- 83
1
A quick way to fix this.
As you mentioned there was a SHELL uploaded on your server., Hence this file must have been gotten inside with some "File Upload or Image Upload" page of your free PHP app.
Go to that page and set the MIME type to accept only IMAGES or DOCUMENTS.
Shankar Narayana Damodaran
- 68,075
- 43
- 96
- 126
-
I'm getting the impression that the app itself contains the shell. In which case no setting anywhere within the app will keep you safe. – cHao Feb 23 '12 at 17:23
-
Maybe... Maybe Not.. Btw..we should ask the name of the free app \. – Shankar Narayana Damodaran Feb 23 '12 at 17:34