PHP Güvenlik Tarama Rehberi

Hızlı Tarama Script'i v3.0 (70 Kontrol)

Tüm 70 kontrolü (v2'nin 50'si + Imunify360'ın 20'si) tek seferde çalıştırmak için:

#!/bin/bash
# PHP Security Scanner v3.0 - 70 Kontrol (Imunify360 İlaveli)
WEBROOT="/var/www/vhosts/tuufi.com/httpdocs"

echo "=== PHP GÜVENLİK TARAMASI v3.0 ==="
echo "=== 70 Kontrol (50 temel + 20 Imunify360) ==="
echo ""

# Kategori 1-14: Temel Kontroller (1-50) - v2'den
echo "[1/70] Eval+Base64..."
grep -r --include="*.php" -l "eval(base64_decode" $WEBROOT --exclude-dir=vendor 2>/dev/null

echo "[10/70] Rastgele isimli dosyalar..."
find $WEBROOT/public -maxdepth 2 -regextype posix-extended -regex '.*/[a-f0-9]{16,}\.[a-z]+$' 2>/dev/null

echo "[13/70] Uploads'da PHP..."
find $WEBROOT/public/uploads -name "*.php" 2>/dev/null

# ... (diğer v2 kontrolleri)

# Kategori 15: Malware Signatures (51-55)
echo "[51/70] SEO Spam..."
grep -ri "viagra\|cialis\|casino" $WEBROOT/public --include="*.php" | grep -i "display.*none" | head -5

echo "[52/70] Malicious Redirects..."
grep -r "window\.location\|meta.*refresh" $WEBROOT/public --include="*.php" | grep -v vendor | head -5

echo "[53/70] Defaced pages..."
grep -ri "hacked by\|owned by" $WEBROOT/public --include="*.html" --include="*.php"

echo "[54/70] Known malware strings..."
grep -r "eval.*base64_decode.*gzinflate" $WEBROOT --include="*.php" --exclude-dir=vendor

echo "[55/70] Suspicious function chains..."
grep -r "file_get_contents.*base64_decode" $WEBROOT --include="*.php" --exclude-dir=vendor | head -5

# Kategori 16: Advanced Detection (56-60)
echo "[56/70] Polymorphic malware..."
find $WEBROOT -name "*.php" -exec grep -l "eval.*\\\$" {} \; | head -5

echo "[57/70] Time-based execution..."
grep -r "date\s*(\|time\s*(" $WEBROOT/public --include="*.php" | grep -i "if" | head -5

echo "[58/70] IP-based backdoors..."
grep -r "REMOTE_ADDR.*==" $WEBROOT/public --include="*.php" --exclude-dir=vendor | head -5

echo "[59/70] User-agent filtering..."
grep -r "HTTP_USER_AGENT" $WEBROOT/public --include="*.php" | grep "if\|preg" | head -5

echo "[60/70] Multi-stage payloads..."
grep -r "eval.*eval\|base64_decode.*base64_decode.*base64" $WEBROOT --include="*.php" --exclude-dir=vendor

# Kategori 17: File Integrity (61-65)
echo "[61/70] Core file modifications..."
find $WEBROOT/vendor/laravel -name "*.php" -mtime -30 ! -path "*/cache/*" 2>/dev/null | head -5

echo "[62/70] Permission anomalies..."
find $WEBROOT -name "*.php" -perm 0777 ! -path "*/storage/*" 2>/dev/null

echo "[63/70] Timestamp manipulation..."
find $WEBROOT/public -name "*.php" -type f -printf "%T@ %p\n" | sort -n | head -10

echo "[64/70] Hidden attributes..."
find $WEBROOT/public -name "*.php" -exec lsattr {} \; 2>/dev/null | grep -E "i-|a-"

echo "[65/70] Suspicious file sizes..."
find $WEBROOT/public -name "*.php" \( -size -100c -o -size +1M \) ! -path "*/vendor/*" 2>/dev/null

# Kategori 18: Behavioral Analysis (66-70)
echo "[66/70] Mass file creation..."
find $WEBROOT -name "*.php" -cmin -60 ! -path "*/vendor/*" ! -path "*/storage/framework/*" 2>/dev/null | wc -l

echo "[67/70] Rapid modifications..."
find $WEBROOT/public -name "*.php" -mmin -60 ! -path "*/storage/*" -ls | head -10

echo "[68/70] Suspicious includes..."
grep -r "include\s*(\s*\$\|require\s*(\s*\$" $WEBROOT/public --include="*.php" --exclude-dir=vendor | head -5

echo "[69/70] External file operations..."
grep -r "file_get_contents.*http.*file_put_contents" $WEBROOT/public --include="*.php" --exclude-dir=vendor | head -5

echo "[70/70] Suspicious variable names..."
grep -r '\$[a-z]\s*=.*eval' $WEBROOT/public --include="*.php" --exclude-dir=vendor | head -5

echo ""
echo "=== TARAMA TAMAMLANDI (v3.0 - 70 Kontrol) ==="