Update WShell_PHP_in_images.yar

62518762 · Vlad · GitHub · cba013d7 · 62518762
Commit 62518762 authored Jul 22, 2016 by Vlad Committed by GitHub Jul 22, 2016
Hide whitespace changes
Inline Side-by-side

Showing with 1 additions and 1 deletions

WShell_PHP_in_images.yar Webshells/WShell_PHP_in_images.yar +1 -1

No files found.
--- a/Webshells/WShell_PHP_in_images.yar
+++ b/Webshells/WShell_PHP_in_images.yar
@@ -10,7 +10,7 @@ rule php_in_image
        description = "Finds image files w/ PHP code in images"
    strings:
        $gif = /^GIF8[79]a/
-        $jfif = { ff d8 ff ee 00 10 4a 46 49 }
+        $jfif = { ff d8 ff e? 00 10 4a 46 49 46 }
        $png = { 89 50 4e 47 0d 0a 1a 0a }

        $php_tag = "<?php"