ob_start[[:space:]]*\(
array_diff_uassoc[[:space:]]*\(
array_diff_ukey[[:space:]]*\(
array_filter[[:space:]]*\(
array_intersect_uassoc[[:space:]]*\(
array_intersect_ukey[[:space:]]*\(
array_map[[:space:]]*\(
array_reduce[[:space:]]*\(
array_udiff_assoc[[:space:]]*\(
array_udiff_uassoc[[:space:]]*\(
array_udiff[[:space:]]*\(
array_uintersect_assoc[[:space:]]*\(
array_uintersect_uassoc[[:space:]]*\(
array_uintersect[[:space:]]*\(
array_walk_recursive[[:space:]]*\(
array_walk[[:space:]]*\(
assert_options[[:space:]]*\(
uasort[[:space:]]*\(
uksort[[:space:]]*\(
usort[[:space:]]*\(
preg_replace_callback[[:space:]]*\(
preg_replace_callback_array[[:space:]]*\(
spl_autoload_register[[:space:]]*\(
iterator_apply[[:space:]]*\(
call_user_func[[:space:]]*\(
call_user_func_array[[:space:]]*\(
register_shutdown_function[[:space:]]*\(
register_tick_function[[:space:]]*\(
set_error_handler[[:space:]]*\(
set_exception_handler[[:space:]]*\(
session_set_save_handler[[:space:]]*\(
sqlite_create_aggregate[[:space:]]*\(
sqlite_create_function[[:space:]]*\(
Closure::bind(To)?[[:space:]]*\(
Closure::call[[:space:]]*\(
# Execution
exec[[:space:]]*\([^;\)]*\$[\(\{]?[_a-zA-Z0-9][^\)]*\)[[:space:]]*[\);]
passthru[[:space:]]*\(.*\)
popen[[:space:]]*\(.*\$.*\)
shell_exec[[:space:]]*\(.*\$.*\)
system[[:space:]]*\([^;]*\$[^\)]+\)
call_user_func[[:space:]]*\(.?.?\$.*,.?\$.*
[= (]`[^`]*\$[\(\{]?[_a-zA-Z0-9][^`]*`
^`[^`]*\$[\(\{]?[_a-zA-Z0-9][^`]*`
#Otherstuffs
#XSS signature needs to stop matching before LF when color=on #bug(1)
echo.*\$_.*\[.*\]
eval[[:space:]]*\(.*\$.*\)
#SQLi signature needs to stop matching before LF when color=on #bug(1)
(mysql.?_|pg_|sqlsrv_|::)query[[:space:]]*\(.*\$.*\)
[Ww][Hh][Ee][Rr][Ee][[:space:]]+.*=.*\$[^; ]+
([Ww][Hh][Ee][Rr][Ee]|[Aa][Nn][Dd]|[Oo][Rr])[[:space:]]+.*[[:space:]]+[Ll][Ii][Kk][Ee][[:space:]]+.*\$
VALUES[[:space:]]*\([^\)]*\$.*\)
^[[:space:]]*(include|include_once|require|require_once)[[:space:]]*\([^\;\}\{]*\$.*\)
print.*param[[:space:]]*\(.*\);
extract[[:space:]]*\(\$_(GET|POST|REQUEST|COOKIE|SERVER)
new[[:space:]]+\$_(GET|REQUEST|POST|COOKIE).*\(
# PHP - Execution
assert([[:space:]]*\(|[[:space:]]+[\"\'])[^\)]+\)?
exec([[:space:]]*\(|[[:space:]]+[\"\'])[^\)]+\)?
`[^`]*\$[^`]+`
passthru([[:space:]]*\(|[[:space:]]+[\"\'])[^\)]+\)?
popen([[:space:]]*\(|[[:space:]]+[\"\'])[^\)]+\)?
proc_close([[:space:]]*\(|[[:space:]]+[\"\'])[^\)]+\)?
proc_open([[:space:]]*\(|[[:space:]]+).*\)?
proc_get_status([[:space:]]*\(|[[:space:]]+).*\)?
proc_nice([[:space:]]*\(|[[:space:]]+).*\)?
proc_terminate([[:space:]]*\(|[[:space:]]+).*\)?
shell_exec([[:space:]]*\(|[[:space:]]+).*\)?
system([[:space:]]*\(|[[:space:]]+[\"\']).*\)?
# Extensions
expect_
pcntl_
posix_
# Semaphore extension
ftok
msg_get_queue
msg_queue_exists
msg_receive
msg_remove_queue
msg_send
msg_set_queue
msg_stat_queue
sem_
shm_
shmop_
# LibXSLT use php functions as XSLT functions
registerPhpFunctions
FFI::cdef[[:space:]]*\(
\$ffi\-\>.*\(
FFI::addr[[:space:]]*\(
FFI::memcpy[[:space:]]*\(
FFI::load[[:space:]]*\(
FFI::free[[:space:]]*\(
FFI::new[[:space:]]*\(
FFI:;string[[:space:]]*\(
escapeshellcmd[[:space:]]*\([^\)]*escapeshellarg[[:space:]]*\(.*
escapeshellarg[[:space:]]*\([^\)]*escapeshellcmd[[:space:]]*\(.*
[\'\"][[:space:]]*\.[[:space:]]*escapeshellcmd[[:space:]]*\(
echo[[:space:]]+.*\$(_ENV|_GET|_POST|_COOKIE|_REQUEST|_SERVER|HTTP|http).*
print[[:space:]]+.*\$(_ENV|_GET|_POST|_COOKIE|_REQUEST|_SERVER|HTTP|http).*
print_r([[:space:]]+|[[:space:]]*\().*\$(_ENV|_GET|_POST|_COOKIE|_REQUEST|_SERVER|HTTP|http).*
\<\?\=\$(_ENV|_GET|_POST|_COOKIE|_REQUEST|_SERVER|HTTP|http)
\<\%\=\$(_ENV|_GET|_POST|_COOKIE|_REQUEST|_SERVER|HTTP|http)
exec[[:space:]]*\(.*\$(_ENV|_GET|_POST|_COOKIE|_REQUEST|_SERVER|HTTP|http).*\)
system[[:space:]]*\(.*\$(_ENV|_GET|_POST|_COOKIE|_REQUEST|_SERVER|HTTP|http).*\)
popen[[:space:]]*\(.*\$(_ENV|_GET|_POST|_COOKIE|_REQUEST|_SERVER|HTTP|http).*\)
proc_open[[:space:]]*\(.*\$(_ENV|_GET|_POST|_COOKIE|_REQUEST|_SERVER|HTTP|http).*\)
pcntl_exec[[:space:]]*\(.*\$(_ENV|_GET|_POST|_COOKIE|_REQUEST|_SERVER|HTTP|http).*\)
shell_exec[[:space:]]*\(.*\$(_ENV|_GET|_POST|_COOKIE|_REQUEST|_SERVER|HTTP|http).*\)
passthru[[:space:]]*\(.*\$(_ENV|_GET|_POST|_COOKIE|_REQUEST|_SERVER|HTTP|http).*\)
`[^`]*\$(_ENV|_GET|_POST|_COOKIE|_REQUEST|_SERVER|HTTP|http)[^`]*`
eval[[:space:]]*\(.*\$(_ENV|_GET|_POST|_COOKIE|_REQUEST|_SERVER|HTTP|http).*\)
header[[:space:]]*\(.*\$(_ENV|_GET|_POST|_COOKIE|_REQUEST|_SERVER|HTTP|http).*\)
include[[:space:]]*\(.*\$(_ENV|_GET|_POST|_COOKIE|_REQUEST|_SERVER|HTTP|http).*\)
include_once[[:space:]]*\(.*\$(_ENV|_GET|_POST|_COOKIE|_REQUEST|_SERVER|HTTP|http).*\)
require[[:space:]]*\(.*\$(_ENV|_GET|_POST|_COOKIE|_REQUEST|_SERVER|HTTP|http).*\)
require_once[[:space:]]*\(.*\$(_ENV|_GET|_POST|_COOKIE|_REQUEST|_SERVER|HTTP|http).*\)
fopen[[:space:]]*\(.*\$(_ENV|_GET|_POST|_COOKIE|_REQUEST|_SERVER|HTTP|http).*\)
readfile[[:space:]]*\(.*\$(_ENV|_GET|_POST|_COOKIE|_REQUEST|_SERVER|HTTP|http).*\)
file_(get|put)_contents[[:space:]]*\(.*\$(_ENV|_GET|_POST|_COOKIE|_REQUEST|_SERVER|HTTP|http).*\)
(is_dir|file_exists|unlink)[[:space:]]*\(\"?\$(_ENV|_GET|_POST|_COOKE|_REQUEST|_SERVER|HTTP|http).*\)
show_source[[:space:]]*\(.*\$(_ENV|_GET|_POST|_COOKIE|_REQUEST|_SERVER|HTTP|http).*\)
preg_replace[[:space:]]*\([\'"](.).*\1[igsu]*e
highlight_file[[:space:]]*\(.*\$(_ENV|_GET|_POST|_COOKIE|_REQUEST|_SERVER|HTTP|http).*\)
file[[:space:]]*\(.*\$(_ENV|_GET|_POST|_COOKIE|_REQUEST|_SERVER|HTTP|http).*\)
unserialize[[:space:]]*\(.*\$(_ENV|_GET|_POST|_COOKIE|_REQUEST|_SERVER|HTTP|http).*\)
mysql_query[[:space:]]*\(.*\$(_ENV|_GET|_POST|_COOKIE|_REQUEST|_SERVER|HTTP|http).*\)
mysqli_query[[:space:]]*\(.*\$(_ENV|_GET|_POST|_COOKIE|_REQUEST|_SERVER|HTTP|http).*\)
mssql_query[[:space:]]*\(.*\$(_ENV|_GET|_POST|_COOKIE|_REQUEST|_SERVER|HTTP|http).*\)
oci_parse[[:space:]]*\(.*\$(_ENV|_GET|_POST|_COOKIE|_REQUEST|_SERVER|HTTP|http).*\)
pg_query[[:space:]]*\(.*\$(_ENV|_GET|_POST|_COOKIE|_REQUEST|_SERVER|HTTP|http).*\)
\->query[[:space:]]*\(.*\$(_ENV|_GET|_POST|_COOKIE|_REQUEST|_SERVER|HTTP|http).*\)
\->query[[:space:]]*\(.*['"][[:space:]]*\.[[:space:]]*\$.*
(WHERE|where)[[:space:]]+.*=.*\$(_ENV|_GET|_POST|_COOKIE|_REQUEST|_SERVER|HTTP|http)[^; ]+
(LIKE|like)[[:space:]]+.*\$(_ENV|_GET|_POST|_COOKIE|_REQUEST|_SERVER|HTTP|http)
(ORDER[[:space:]]+BY|order[[:space:]]+by)[[:space:]]+.*\$(_ENV|_GET|_POST|_COOKIE|_REQUEST|_SERVER|HTTP|http)
(LIMIT|limit)[[:space:]]+.*\$(_ENV|_GET|_POST|_COOKIE|_REQUEST|_SERVER|HTTP|http)
VALUES[[:space:]]*\([^\)]*\$(_ENV|_GET|_POST|_COOKIE|_REQUEST|_SERVER|HTTP|http)
# PHP hash extension rules, helps to identify Hard-coded credentials/secret
hash[[:space:]]*\(.*\)
hash_init[[:space:]]*\(.*\)
hash_update[[:space:]]*\(.*\)
# Informatin disclosure
phpinfo[[:space:]]*\(.*\)
phpcredits[[:space:]]*\(.*\)
php_logo_guid[[:space:]]*\(.*\)
php_uname[[:space:]]*\(.*\)
phpversion[[:space:]]*\(.*\)
zend_logo_guid[[:space:]]*\(.*\)
zend_version[[:space:]]*\(.*\)
get_loaded_extensions[[:space:]]*\(.*\)
mqseries_connx?[[:space:]]*\(
mqseries_open[[:space:]]*\(
AMQPStreamConnection[[:space:]]*\(
\-\>basic_publish[[:space:]]*\(
\-\>queue_declare[[:space:]]*\(
#https://www.php-fig.org/psr/psr-7/
(::|\-\>)getAttribute[[:space:]]*\(.*
(::|\-\>)getAttributes[[:space:]]*\(.*
(::|\-\>)getAuthority[[:space:]]*\(.*
(::|\-\>)getBody[[:space:]]*\(.*
(::|\-\>)getClientFilename[[:space:]]*\(.*
(::|\-\>)getClientMediaType[[:space:]]*\(.*
(::|\-\>)getCookieParams[[:space:]]*\(.*
(::|\-\>)getHeaderLine[[:space:]]*\(.*
(::|\-\>)getHeader[[:space:]]*\(.*
(::|\-\>)getHeaders[[:space:]]*\(.*
(::|\-\>)getHost[[:space:]]*\(.*
(::|\-\>)getMethod[[:space:]]*\(.*
(::|\-\>)getParsedBody[[:space:]]*\(.*
(::|\-\>)getPath[[:space:]]*\(.*
(::|\-\>)getQueryParams[[:space:]]*\(.*
(::|\-\>)getQuery[[:space:]]*\(.*
(::|\-\>)getRequestTarget[[:space:]]*\(.*
(::|\-\>)getScheme[[:space:]]*\(.*
(::|\-\>)getServerParams[[:space:]]*\(.*
(::|\-\>)getUploadedFiles[[:space:]]*\(.*
(::|\-\>)getUri[[:space:]]*\(.*
(::|\-\>)getUserInfo[[:space:]]*\(.*
(::|\-\>)hasHeader[[:space:]]*\(.*
(::|\-\>)moveTo[[:space:]]*\(.*
(::|\-\>)withAddedHeader[[:space:]]*\(.*
(::|\-\>)withAttribute[[:space:]]*\(.*
(::|\-\>)withBody[[:space:]]*\(.*
(::|\-\>)withCookieParams[[:space:]]*\(.*
(::|\-\>)withHeader[[:space:]]*\(.*
(::|\-\>)withHost[[:space:]]*\(.*
(::|\-\>)withMethod[[:space:]]*\(.*
(::|\-\>)withParsedBody[[:space:]]*\(.*
(::|\-\>)withPath[[:space:]]*\(.*
(::|\-\>)withQueryParams[[:space:]]*\(.*
(::|\-\>)withQuery[[:space:]]*\(.*
(::|\-\>)withRequestTarget[[:space:]]*\(
(::|\-\>)withUploadedFiles[[:space:]]*\(.*
(::|\-\>)withUri[[:space:]]*\(.*
(::|\-\>)withUserInfo[[:space:]]*\(.*
\-\>setPassword[[:space:]]*\(
\-\>loadKey[[:space:]]*\(
\-\>login[[:space:]]*\([^\,]+\,[^\,]+\)
# PHP - Database
mysql_connect[[:space:]]*\(.*\$.*\)
mysql_pconnect[[:space:]]*\(.*\$.*\)
mysql_change_user[[:space:]]*\(.*\$.*\)
mysql_query[[:space:]]*\(.*\$.*\)
mysql_error[[:space:]]*\(.*\$.*\)
mysql_set_charset[[:space:]]*\(.*\$.*\)
mysql_unbuffered_query[[:space:]]*\(.*\$.*\)
mysqli_.*[[:space:]]*\(.*\$.*\)
pg_connect[[:space:]]*\(.*\$.*\)
pg_pconnect[[:space:]]*\(.*\$.*\)
pg_execute[[:space:]]*\(.*\$.*\)
pg_insert[[:space:]]*\(.*\$.*\)
pg_put_line[[:space:]]*\(.*\$.*\)
pg_query[[:space:]]*\(.*\$.*\)
pg_select[[:space:]]*\(.*\$.*\)
pg_send_query[[:space:]]*\(.*\$.*\)
pg_set_client_encoding[[:space:]]*\(.*\$.*\)
pg_update[[:space:]]*\(.*\$.*\)
sqlite_open[[:space:]]*\(.*\$.*\)
sqlite_poen[[:space:]]*\(.*\$.*\)
sqlite_query[[:space:]]*\(.*\$.*\)
sqlite_array_query[[:space:]]*\(.*\$.*\)
sqlite_create_function[[:space:]]*\(.*\$.*\)
sqlite_create_aggregate[[:space:]]*\(.*\$.*\)
sqlite_exec[[:space:]]*\(.*\$.*\)
sqlite_fetch_.*[[:space:]]*\(.*\$.*\)
msql_.*[[:space:]]*\(.*\$.*\)
mssql_.*[[:space:]]*\(.*\$.*\)
odbc_.*[[:space:]]*\(.*\$.*\)
fbsql_.*[[:space:]]*\(.*\$.*\)
sybase_.*[[:space:]]*\(.*\$.*\)
ibase_.*[[:space:]]*\(.*\$.*\)
dbx_.*[[:space:]]*\(.*\$.*\)
ingres_.*[[:space:]]*\(.*\$.*\)
ifx_.*[[:space:]]*\(.*\$.*\)
oci_.*[[:space:]]*\(.*\$.*\)
sqlsrv_.*[[:space:]]*\(.*\$.*\)
px_.*[[:space:]]*\(.*\$.*\)
ovrimos_.*[[:space:]]*\(.*\$.*\)
maxdb_.*[[:space:]]*\(.*\$.*\)
db2_.*[[:space:]]*\(.*\$.*\)
->sqliteCreate(Agregate|Collation|Function)[[:space:]]*\(
->create(Aggregate|Collation|Function)[[:space:]]*\(
querySingle[[:space:]]*\(
[A-Z]+::expr\(.*\$.*\)
CURLOPT_SSL_VERIFY(HOST|PEER), *([Ff][Aa][Ll][Ss][Ee]|0)
unserialize[[:space:]]*\(.*\$.*
file_exists[[:space:]]*\(\"?\$.*
is_dir[[:space:]]*\(\"?\$
md5_file[[:space:]]*\(\"?\$.*
filemtime[[:space:]]*\(\"?\$.*
filesize[[:space:]]*\(\"?\$.*
file_get_contents[[:space:]]*\(.*\$.*
fopen[[:space:]]*\(.*\$.*
file[[:space:]]*\(.*\$.*
file_(get|put)_contents[[:space:]]*\(.*\$
fread[[:space:]]*\(
fwrite[[:space:]]*\(
scandir[[:space:]]*\(.*
php://stdin
php://stdout
php://stderr
php://output
php://input
php://filter
php://memory
php://temp
phar://.*\$.*
expect://
# PHP - Superglobals & Environment
getenv[[:space:]]*\(.*\)
apache_getenv[[:space:]]*\(.*\)
putenv[[:space:]]*\(.*\)
apache_setenv[[:space:]]*\(.*\)
getallheaders[[:space:]]*\(.*\)
apache_request_headers[[:space:]]*\(.*\)
apache_response_headers[[:space:]]*\(.*\)
\$_ENV\[.*\]
\$_GET\[.*\]
\$_POST\[.*\]
\$_COOKIE\[.*\]
\$_REQUEST\[.*\]
\$_FILES\[.*\]
\$_SERVER\[.*\]
\$PHPSELF
\$HTTP_GET_VARS
\$http_get_vars
\$HTTP_POST_VARS
\$http_post_vars
\$HTTP_ENV_VARS
\$http_env_vars
\$HTTP_RAW_POST_DATA
\$http_raw_post_data
\$HTTP_POST_FILES
\$http_post_files
import_request_variables[[:space:]]*\(
PHP_AUTH_USER
PHP_AUTH_PW
# Variable variables aren't superglobals, but bad idea
\$\$.*
# Otherstuffs
header[[:space:]]*\(.*\$_(GET|POST|REQUEST|COOKIE).*\)
eval[[:space:]]*\([[:space:]]*.\$.*[[:space:]]*\)
file[[:space:]]*\(.\$.*\)
file_get_contents[[:space:]]*\(.\$.*\)
fopen[[:space:]]*\(.*\$.*\)
p?fsockopen[[:space:]]*\(.*\)
stream_context_create[[:space:]]*\(.*\)
fwrite
move_uploaded_file[[:space:]]*\(.*\)
stream_
create_function[[:space:]]*\(.*\)
mail[[:space:]]*\(.\$.*\)
include[[:space:]]*\(.*\$.*\)
include_once[[:space:]]*\(.*\$.*\)
preg_replace[[:space:]]*\(.\$*\)
preg_match[[:space:]]*\(.*
readfile[[:space:]]*\(.\$.*\)
require[[:space:]]*\(.*\$.*\)
require_once[[:space:]]*\(.*\$.*\)
# Stefan Esser's research
unserialize[[:space:]]*\(.*\)
unserialize_callback_func
# PHP xss signatures
echo[[:space:]]+.*\$(_ENV|_GET|_POST|_COOKIE|_REQUEST|_SERVER|HTTP|http).*
print[[:space:]]+.*\$(_ENV|_GET|_POST|_COOKIE|_REQUEST|_SERVER|HTTP|http).*
print_r([[:space:]]*\(|[[:space:]]+).*\)?\$(_ENV|_GET|_POST|_COOKIE|_REQUEST|_SERVER|HTTP|http).*
\<[\?\%]\=\$(_ENV|_GET|_POST|_COOKIE|_REQUEST|_SERVER|HTTP|http)