Web Directories Monitor Script

Question

I have some troubles with injections on my shared hosting account where I run a lot of sites with a lot of different technologies: wordpress, drupal, joomla, osticket etc...

I installed wordpress file monitor for wordpress and that seems to report nicely if something is injected though it misses sometimes changes to themes.

I wonder if someone knows of a preferably perl script that I could cron to report me changed and added files each day so that I can walk through them each day and see if something weird is happening with them. It would be even cooler if this script would check for base 64 injections and then place a checkmark before it.

I prefer something not that I have to place in the web directories since these seem to be the most vulnerable.

Answer 1

Tripwire is a configurable open source tool which monitors for changes to files, though you would need to learn to configure it and manage approved file system changes (unless you don't mind receiving lots of alerts).

In this case, however, it would make a lot more sense to fix the problem at its source: update the software you are running and consider setting allow_url_include to "false" in your PHP configuration.