Malware scanner for websites code?

Question

I have multiple Linux CentOS servers that are scanned with the Google Webmaster Tools and when it finds some malicious code on my servers (shared/dedicated), the ranking of those site drops.

What I am looking for is a server scanner that scans .php, .js files and the likes for malware code, so that I can react before Google drops the ranking of that site.

I already found a php malware scanner (nbs-system/php-malware-finder: Detect potentially malicious PHP files), still trying to get it to work, but I would like to find a more complete solution, to increase the security of my servers.

Is there a server/website specific malware scanner?

Note: Not looking for a fully fledged antivirus product, looking for a, preferably open source, malware scanner that scans web code, not .exe, .dll, just specifically the web codes.

---

I know that to protect your Linux servers you have to configure it securely. But, we have multiple servers: shared/dedicated with thousands of sites running on it. Allot of came from other hosting companies. Pretty much all CMS out there are running on our servers, for some customers(majority WordPress) .

That's why I'm not looking for a website scanner, but a server scanner. To protect our customers when they have been hacked, sooner or latter they will complain to use, and that can be complaints in the thousands!

Answer 1

Try the following scanners to detect potentially malicious PHP files:

• phpscanner;

  PHP scanner written in Python for identifying PHP backdoors and php malicious code. This tool is mainly reusing below mentioned tools. To use this tool, you need to install yara library for Python from the source.

• php-malware-finder;

  Does its very best to detect obfuscated/dodgy code as well as files using PHP functions often used in malwares/webshells. Detection is performed by crawling the filesystem and testing files against a set of YARA rules.

• php-malware-scanner;

  Scans the current working directory and display results with the score greater than the given value. Released under the MIT license.

• Yasca (GitHub) - an open source program which looks for security vulnerabilities, code-quality, performance, and conformance.

• Acunetix Web Security Scanner

  Acunetix WVS automatically checks your web applications for SQL Injection, XSS & other web vulnerabilities.

• RIPS - A static source code analyser for vulnerabilities in PHP .scripts

• Nikto (GitHub) - an open source web server scanner which performs comprehensive tests against web servers for multiple items, including potentially dangerous files/program.

• ClamAV extension for PHP (php-clamav) - a fork of the php-clamavlib project allows to incorporate virus scanning features in your PHP scripts.

Older projects: securityscanner, phpsecaudit.

Check also the following security websites:

• SecTools.Org

• PHP Security Consortium

  Founded in January 2005, the PHP Security Consortium (PHPSC) is an international group of PHP experts dedicated to promoting secure programming practices within the PHP community. Members of the PHPSC seek to educate PHP developers about security through a variety of resources, including documentation, tools, and standards.

---

See also:

• Testing a server for security vulnerabilities
• OpenSource Security scan tools for REST APIs