Search PHP files for typical malware patterns
find eval base64_decode in php files | scan website for php malware | search for obfuscated php code | grep | malware | phpgrep -rlE --include='*.php' 'eval\((base64_decode|gzinflate|gzuncompress|str_rot13)\(' /var/www/vhosts/example.com/httpdocsRecursively searches all PHP files for code that decodes obfuscated data and executes it directly. This combination is typical of web shells and injected malicious code and rarely appears in clean code. Only the file names of matches are printed.
Note: This does not replace a malware scanner and does not find every variant. Look closely at matches in well-known libraries before deleting anything.
Also searched as
- find eval base64_decode in php files
- scan website for php malware
- search for obfuscated php code