NodeJS Web Exploit Detector

The Web Exploit Detector is a Node.js application (and NPM module) used to detect possible infections, malicious code and suspicious files in web hosting environments. This application is intended to be run on web servers hosting one or more websites. Running the application will generate a list of files that are potentially infected together with a description of the infection and references to online resources relating to it.

npm install -g web_exploit_detector

If you have installed Web Exploit Detector as an NPM module (see above) then running the scanner is as simple as running the following command, passing in the path to your webroot (location of your website files): -

wed-scanner --webroot=/var/www/html

Other command-line options are available, simply run wed-scanner --help to see a help message describing them.

Running the script in this way will produce human-readable output to the console. This is very useful when running the script with cron for example as the output can be sent as an e-mail whenever the script runs.

The script also supports the writing of results to a more computer-friendly JSON format for later processing. To enable this output, see the --output command line argument.

Github Project