How do I check if a script is a rogue

flyswatter

I hope this is the correct forum to post this in...

Quick question?

What would you look for, like a "string", code, etc., in a php script, that could
either phone home, opened a back door, sent mail, etc.?

What would you search for?

Reason I ask is that someone is modifying a photogallery and forum for me and the other day I received a bounced mail from "nobody" that had my servers phpinfo!

Now it may be other scripts I personally am experimenting with that I dl'd from script sites like hotscripts...

Are there any obvious strings I should be looking for.

TIA

Weedpacket

No; it's not the correct forum.

flyswatter

gee

is this how you managed to ringup 10,974 posts?

very helpful

pjleonhardt

Actually he tends to be quite helpful. Must be having a rough day.

Back to your question:
I'd scan the documents for a call to the mail function.. Especially if it isn't supposed to have one. Not really knowing what the code is... or what it's supposed to do, there isn't much we can really say since we might say watch out for something that is indeed supposed to be there based on the purpose of the script.

flyswatter

Thanks for the reply

I have to admit I'm having a bad day since this bounced email was the output of phpinfo. It has me concerned.

I've looked thru every log trying to spot something that would tell me which script but can't see anything. It's almost as if someone ssh'd in and sent mail just to prove a point!

Also to say, I'm experimening and installed more scripts "just for the fun of it', than I probably should have.