DE

↑ ↓ select, Enter open, Esc close

Find hidden PHP files in the web directory

harmlessSecurityalle
Adjust the values, the command updates live
user@server
find /var/www/vhosts/example.com/httpdocs -type f -name '.*.php' -ls

Searches below the web directory for PHP files whose name starts with a dot. Such files do not appear in many FTP clients or in ls without -a, which is why they are popular for backdoors. Legitimate applications rarely use this naming, and .user.ini for example is not a PHP file and therefore does not show up.

Note: Open and check each match before deleting it. Other manipulated files are often nearby.

Also searched as

  • find hidden php files
  • dot php files webshell
  • search for hidden backdoor files

Related one-liners

All in Security

Find PHP files in the WordPress uploads folder

$find /var/www/vhosts/example.com/httpdocs/wp-content/uploads -type f \( -iname '*.php' -o -iname '*.phtml' -o -iname '*.php[0-9]' \) -ls
harmlessSecurity

Find recently modified PHP files

$find /var/www/vhosts/example.com/httpdocs -type f -name '*.php' -mtime -7 -printf '%TY-%Tm-%Td %TH:%TM %p\n' | sort -r
harmlessSecurity

Find processes whose executable was deleted

#ls -l /proc/*/exe 2>/dev/null | grep '(deleted)'
harmlessSecurity

Find world-writable files and directories

$find /var/www/vhosts -xdev -perm -0002 ! -type l -ls 2>/dev/null
harmlessSecurity

List all SSH keys authorized on the server

#find / -xdev -path '*/.ssh/authorized_keys' -type f -exec awk 'NF && !/^#/ {print FILENAME ": " $NF}' {} + 2>/dev/null
harmlessSecurity

Search PHP files for typical malware patterns

$grep -rlE --include='*.php' 'eval\((base64_decode|gzinflate|gzuncompress|str_rot13)\(' /var/www/vhosts/example.com/httpdocs
harmlessSecurity

Read first, then run.

The commands on myline.de act directly on servers, files and databases. A wrong path or placeholder can delete data irreversibly or make a server unreachable.

  • All commands are provided without warranty and are not tested on every system.
  • Understand what a command does before running it, and check every placeholder.
  • Make a backup first and, if possible, try it on a test system.
  • You run commands at your own risk. Liability for damages is excluded to the extent permitted by law.