[Community-sigs] php

Рома Слєпчик roma at slepchik.com.ua
Thu Aug 3 07:46:02 EDT 2017


hi.
i try write signature for php inject with base64 encode and need some help.
all injections always insert into first line of file and have size more
4000 symbols begin with <?php and close ?>. i try use sig
3c3f70687020{4000-}3f3e0a but it not work, because into 4000- include 0a.
how can stop check file after first match 0a? or how can i check only first
line of file?
add example file https://www.dropbox.com/s/ppzgf6aa1hqk60y/object.php?dl=0

i can write sig for this injection but new injections always change. stable
always more 4000 symbols and <?php  ?>



More information about the Community-sigs mailing list