webshell-analyzer 1.0.0__py3-none-any.whl

webshell_analyzer/cli/cli.py

@@ -0,0 +1,151 @@
+import pyfiglet
+import cmd
+import os
+import shlex
+import json
+import sys
+from colorama import Fore, Style, init
+from webshell_analyzer.modules.detector import detect_file
+from webshell_analyzer.modules.scanner import scan_directory
+
+sys.stdout.reconfigure(encoding='utf-8')
+init(autoreset=True)
+
+def banner ():
+    f = pyfiglet.figlet_format("W3bshell-Analyzer", font="big_money-se")
+    print(Fore.MAGENTA + f)
+    print(Fore.MAGENTA + "Webshell Analyzer Tool Integrating Machine Learning".center(80))
+    print(Fore.MAGENTA + "Based on Extracting Features from PHP Source Code".center(80))
+    print(Fore.MAGENTA + "=" * 80)
+    print(Fore.MAGENTA + "Author : Adelia Saputri")
+    print(Fore.MAGENTA + "Github : https://github.com/adeliasaputri")
+    print(Fore.MAGENTA + "Email  : adelias.dev@gmail.com")
+    print(Fore.MAGENTA + "Engine : AST + Lexical + Statistical Features")
+    print(Fore.MAGENTA + "=" * 80 + "\n")
+
+def parse_args(args):
+    path = None
+    output = None
+    output_missing = False
+
+    i = 0
+    while i < len(args):
+        if args[i] == "--output":
+            if i + 1 < len(args) and not args[i + 1].startswith("--"):
+                output = args[i + 1]
+                i += 1
+            else:
+                output_missing = True
+        else:
+            path = args[i]
+        i += 1
+    return path, output, output_missing
+
+class webshell_cmd(cmd.Cmd):
+    prompt = Fore.MAGENTA + "w3bshell-analyzer> "
+
+    def do_scan(self, arg):
+        """Scan Directory: scan <directory_path>"""
+        try :
+            args = shlex.split(arg)
+        except :
+            print(Fore.RED + "Error: Invalid arguments. Usage: scan <path> [--output <output_file>]")
+            return
+        
+        if len(args) == 0:
+            print(Fore.RED + "[ERROR] Path is required. Usage: scan <path> [--output <output_file>]")
+            return
+        
+        directorypath, output, output_missing = parse_args(args)
+
+        if output_missing:
+            print(Fore.RED + "[ERROR] flag '--output' is requires a filename argument. Usage: detect <file_path> --output <output_file.json>")
+            return
+
+        if not os.path.isdir(directorypath):
+            print(Fore.RED + f"[ERROR] Path '{directorypath}' is not a valid directory.")
+            return
+        
+        #Validasi output
+        if output is not None:
+            output_dir = os.path.dirname(output)
+            if output_dir != "" and not os.path.isdir(output_dir):
+                print(Fore.RED + f"[ERROR] Cannot save output to Directory \"{output_dir}\". Please ensure the destination folder exists before saving!")
+                return
+            if not output.endswith(".json"):
+                print(Fore.RED + f"[ERROR] Output file must have a .json extension")
+                return
+
+        print(Fore.GREEN + f"[SCANNING DIRECTORY..]: {directorypath}\n")
+        result = scan_directory(directorypath, output_file=output)
+    
+    def do_detect(self, arg):
+        """Detect File: detect <file_path>"""
+        try :
+            args = shlex.split(arg)
+        except :
+            print(Fore.RED + "[ERROR] Invalid arguments. Usage: detect <file_path> [--output <output_file>]")
+            return
+        
+        if len(args) == 0:
+            print(Fore.RED + "[ERROR] Path is required. Usage: detect <path> [--output <output_file>]")
+            return
+        
+        filepath, output, output_missing = parse_args(args)
+
+        if output_missing:
+            print(Fore.RED + "[ERROR] flag '--output' is requires a filename argument. Usage: detect <file_path> --output <output_file.json>")
+            return
+
+        if not os.path.isfile(filepath):
+            print(Fore.RED + f"[ERROR] File '{filepath}' does not exist.")
+            return
+
+        #Validasi output
+        if output is not None:
+            output_dir = os.path.dirname(output)
+            if output_dir != "" and not os.path.isdir(output_dir):
+                print(Fore.RED + f"[ERROR] Cannot save output to Directory {output_dir}")
+                print(Fore.RED + f"Please ensure the destination folder exists before saving")
+                return
+            if not output.endswith(".json"):
+                print(Fore.RED + f"[ERROR] Output file must have a .json extension")
+                return
+        
+        print (Fore.GREEN + f"[ANALYZING..] {filepath}")
+        detect_file(filepath, output_file=output)
+
+
+    def do_help(self, arg):
+        """Show help message"""
+        print(Fore.CYAN + "=" * 50)
+        print(Fore.CYAN + "AVAILABLE COMMANDS: \n")
+        print(Fore.CYAN + "scan <directory_path> [--output <output_file.json>] -> scan all PHP files in a directory for webshell detection")
+        print(Fore.CYAN + "detect <file_path> [--output <output_file.json>] -> detect a specific file for webshell activity")
+        print(Fore.CYAN + "help -> for show this help message")
+        print(Fore.CYAN + "exit -> For Exit the Webshell Analyzer")
+        print(Fore.CYAN + "=" * 50)
+        print(Fore.CYAN + "OPTIONAL ARGUMENTS: \n")
+        print(Fore.CYAN + "--output <output_file.json> -> Save the detection results to a JSON file")
+        print(Fore.CYAN + "=" * 50 + "\n")
+
+    def do_exit(self, arg):
+        """Exit the webshell analyzer"""
+        print(Fore.GREEN + "Exiting webshell analyzer, Goodbye!")
+        return True
+    
+    def default(self, line):
+        """Handle unknown commands"""
+        print(Fore.RED +  "Unknown command: " + f'{line}')
+        print("Type 'help' for a list of available commands.\n")
+
+    def emptyline(self):
+        pass
+
+def main() :
+    banner()
+    webshell_cmd().cmdloop()
+
+if __name__ == "__main__":
+    main()
+

webshell_analyzer/extractor/ast_extraction/composer.json

@@ -0,0 +1,5 @@
+{
+    "require": {
+        "nikic/php-parser": "^5.7"
+    }
+}

webshell_analyzer/extractor/ast_extraction/composer.lock

@@ -0,0 +1,77 @@
+{
+    "_readme": [
+        "This file locks the dependencies of your project to a known state",
+        "Read more about it at https://getcomposer.org/doc/01-basic-usage.md#installing-dependencies",
+        "This file is @generated automatically"
+    ],
+    "content-hash": "efef34747d233325e6e1b13c0f9b9df0",
+    "packages": [
+        {
+            "name": "nikic/php-parser",
+            "version": "v5.7.0",
+            "source": {
+                "type": "git",
+                "url": "https://github.com/nikic/PHP-Parser.git",
+                "reference": "dca41cd15c2ac9d055ad70dbfd011130757d1f82"
+            },
+            "dist": {
+                "type": "zip",
+                "url": "https://api.github.com/repos/nikic/PHP-Parser/zipball/dca41cd15c2ac9d055ad70dbfd011130757d1f82",
+                "reference": "dca41cd15c2ac9d055ad70dbfd011130757d1f82",
+                "shasum": ""
+            },
+            "require": {
+                "ext-ctype": "*",
+                "ext-json": "*",
+                "ext-tokenizer": "*",
+                "php": ">=7.4"
+            },
+            "require-dev": {
+                "ircmaxell/php-yacc": "^0.0.7",
+                "phpunit/phpunit": "^9.0"
+            },
+            "bin": [
+                "bin/php-parse"
+            ],
+            "type": "library",
+            "extra": {
+                "branch-alias": {
+                    "dev-master": "5.x-dev"
+                }
+            },
+            "autoload": {
+                "psr-4": {
+                    "PhpParser\\": "lib/PhpParser"
+                }
+            },
+            "notification-url": "https://packagist.org/downloads/",
+            "license": [
+                "BSD-3-Clause"
+            ],
+            "authors": [
+                {
+                    "name": "Nikita Popov"
+                }
+            ],
+            "description": "A PHP parser written in PHP",
+            "keywords": [
+                "parser",
+                "php"
+            ],
+            "support": {
+                "issues": "https://github.com/nikic/PHP-Parser/issues",
+                "source": "https://github.com/nikic/PHP-Parser/tree/v5.7.0"
+            },
+            "time": "2025-12-06T11:56:16+00:00"
+        }
+    ],
+    "packages-dev": [],
+    "aliases": [],
+    "minimum-stability": "stable",
+    "stability-flags": {},
+    "prefer-stable": false,
+    "prefer-lowest": false,
+    "platform": {},
+    "platform-dev": {},
+    "plugin-api-version": "2.6.0"
+}

webshell_analyzer/extractor/ast_extraction/src/NodeVisitor.php

@@ -0,0 +1,85 @@
+<?php
+
+namespace NodeVisitor;
+
+require_once __DIR__ . '/../vendor/autoload.php';
+require_once __DIR__ . '/featuresDeclare.php';
+
+use Features\featureWrapper;
+use PhpParser\NodeVisitorAbstract;
+use PhpParser\Node;
+use PhpParser\Node\Name;
+use PhpParser\Node\Expr;
+use PhpParser\Node\Stmt;
+
+class NodeVisitor extends NodeVisitorAbstract {
+    private featureWrapper $features;
+    private array $superglobal = ['_GET', '_POST', '_COOKIE', '_REQUEST', '_FILES', '_ENV', '_SERVER', '_SESSION', 'GLOBALS'];
+
+     public function __construct(featureWrapper $features){
+        $this->features = $features;
+    }
+
+    public function enterNode(Node $node) {
+        $this->handleDynamicFeatures($node);
+        $this->handleStructuralFeatures($node);
+    }
+    
+    private function getFuncName(Node $node): ?string {
+        if($node instanceof Expr\FuncCall && $node->name instanceof Name){
+            return strtolower($node->name->toString());
+        }
+        return null;
+    }
+
+    private function isSuperglobal(Node $node): bool {
+        return $node instanceof Expr\ArrayDimFetch && $node->var instanceof Expr\Variable && is_string($node->var->name) && in_array($node->var->name, $this->superglobal);
+    }
+
+    private function handleDynamicFeatures(Node $node){
+        #dynamic function call exists (dynamicFuncCallExists feature)
+        if($node instanceof Expr\FuncCall && $node->name instanceof Expr\Variable){
+            $this->features->dynamicFeatures->dynamicFuncCallExists = true;
+        }
+        #check for variable variables (varExists feature)
+        if($node instanceof Expr\Variable && $node->name instanceof Expr\Variable){
+            $this->features->dynamicFeatures->varExists = true;
+        }
+        #count variable usage (varUsageCount feature)
+        if($node instanceof Expr\Variable){
+            $this->features->dynamicFeatures->varUsageCount++;
+        }
+        #count assignments (assignmentCount feature)
+        if($node instanceof Expr\Assign){
+            $this->features->dynamicFeatures->assignmentCount++;
+        }
+    }
+
+    private function handleStructuralFeatures(Node $node) {
+
+        #class definition exists (classDefExists feature)
+        if($node instanceof Stmt\Class_){
+            $this->features->structuralFeatures->classDefExists = true;
+        }
+
+        #count function definitions (funcDefCount feature)
+        if($node instanceof Stmt\Function_ || $node instanceof Stmt\ClassMethod){
+            $this->features->structuralFeatures->funcDefCount++;
+        }
+
+        #count superglobal used as function argument (superglobalAsFuncArg feature)
+        if($node instanceof Expr\FuncCall ){
+            foreach($node->args as $arg){
+                if($this->isSuperglobal($arg->value)){
+                    $this->features->structuralFeatures->superglobalAsFuncArg++;
+                }
+            }
+        }
+
+        #count suspicious concatenation (suspiciousConcat feature)
+        if($node instanceof Expr\BinaryOp\Concat){
+            $this->features->structuralFeatures->suspiciousConcat = ($this->features->structuralFeatures->suspiciousConcat ?? 0) + 1;
+        }
+    }
+}
+?>

webshell_analyzer/extractor/ast_extraction/src/astBuilder.php

@@ -0,0 +1,50 @@
+<?php
+
+require_once __DIR__ . '/../vendor/autoload.php';
+require_once __DIR__ . '/featuresDeclare.php';
+require_once __DIR__ . '/NodeVisitor.php';
+
+
+use PhpParser\ParserFactory;
+use PhpParser\NodeTraverser;
+use Features\featureWrapper;
+use NodeVisitor\NodeVisitor;
+use PhpParser\PhpVersion;
+
+class astBuilder
+{
+    public $parser;
+
+    public function __construct()
+    {
+        $factory = new ParserFactory();
+        $this->parser = $factory->createForVersion(PhpParser\PhpVersion::fromString('5.6'));
+    }
+
+    public function builder($code)
+    {
+        
+        $feature = new featureWrapper();
+#debug
+        $code = preg_replace('/\$(\w+)\{([^}]+)\}/', '$\1[\2]', $code);
+        $code = str_replace(["<?PHP", "<?Php"], "<?php", $code);
+        $code = str_replace('@', '', $code);
+
+        try {
+            $stmts = $this->parser->parse($code);
+        } catch (\Throwable $e) {
+            error_log("Parse error in code: " . $e->getMessage());
+            return $feature->toArray();
+        }
+
+        $traverser = new NodeTraverser();
+        $visitor = new NodeVisitor($feature);
+        $traverser->addVisitor($visitor);
+        $traverser->traverse($stmts);
+
+        return $feature->toArray();
+    }
+
+}
+
+?>

webshell_analyzer/extractor/ast_extraction/src/astExtractor.php

@@ -0,0 +1,50 @@
+<?php
+error_reporting(0);
+ini_set('display_errors', 0);
+ini_set('log_errors', 0);
+
+ob_start();
+
+
+require_once __DIR__ . '/../vendor/autoload.php';
+require_once __DIR__ . '/astBuilder.php';
+
+if($argc < 2) {
+    echo json_encode("Error: No file path provided") . "\n";
+    exit(1);
+}
+
+$filepath = $argv[1];
+
+if(!file_exists($filepath)) {
+    echo json_encode("Error: File not found: $filepath") . "\n";
+    exit(1);
+}
+
+
+$code = file_get_contents($filepath);
+$code = trim($code);
+
+
+if ($code === false || trim($code) === '') {
+    echo json_encode("Error Empty file");
+    exit(1);
+}
+
+$builder = new astBuilder();
+
+$result = $builder->builder($code);
+
+
+if (!is_array($result)) {
+    echo json_encode(["error" => "Builder did not return array"]);
+    exit(1);
+}
+
+if(ob_get_length()){
+    ob_clean();
+}
+
+// Output valid
+echo json_encode($result);
+?>

webshell_analyzer/extractor/ast_extraction/src/featuresDeclare.php

@@ -0,0 +1,36 @@
+<?php
+
+namespace Features;
+
+class dynamicFeatures{
+    public bool $dynamicFuncCallExists = false;
+    public bool $varExists = false;
+    public int $varUsageCount = 0;
+    public int $assignmentCount = 0;
+}
+
+class structuralFeatures{
+    public bool $classDefExists = false;
+    public int $funcDefCount = 0;
+    public int $superglobalAsFuncArg = 0;
+    public int $suspiciousConcat = 0;
+}
+
+class featureWrapper{
+    public dynamicFeatures $dynamicFeatures;
+    public structuralFeatures $structuralFeatures;
+
+    public function __construct(){
+        $this->dynamicFeatures = new dynamicFeatures();
+        $this->structuralFeatures = new structuralFeatures();
+    }
+
+    public function toArray(): array {
+        return array_merge(
+           get_object_vars($this->dynamicFeatures),
+           get_object_vars($this->structuralFeatures)
+        );
+    }
+}
+
+?>

webshell_analyzer/extractor/ast_extraction/vendor/autoload.php

@@ -0,0 +1,25 @@
+<?php
+
+// autoload.php @generated by Composer
+
+if (PHP_VERSION_ID < 50600) {
+    if (!headers_sent()) {
+        header('HTTP/1.1 500 Internal Server Error');
+    }
+    $err = 'Composer 2.3.0 dropped support for autoloading on PHP <5.6 and you are running '.PHP_VERSION.', please upgrade PHP or use Composer 2.2 LTS via "composer self-update --2.2". Aborting.'.PHP_EOL;
+    if (!ini_get('display_errors')) {
+        if (PHP_SAPI === 'cli' || PHP_SAPI === 'phpdbg') {
+            fwrite(STDERR, $err);
+        } elseif (!headers_sent()) {
+            echo $err;
+        }
+    }
+    trigger_error(
+        $err,
+        E_USER_ERROR
+    );
+}
+
+require_once __DIR__ . '/composer/autoload_real.php';
+
+return ComposerAutoloaderInit9622dd827becd4430ae91af9e0a4face::getLoader();