cxs

Changes:

• Added new option –script [script] which runs an external script whenever a match is detected against a file. See documentation for more information
• Exploit regex definitions database additions
• Exploit fingerprint definitions database additions

Changes:

• Significant improvements to –decode [file]
• Increased LWP timeout to cater for servers with slow connections to the license server
• Added total Viruses and Fingerprint Matches to the –mail Subject
• Added total Fingerprint Matches to the –summary
• Exploit regex definitions database additions
• Exploit fingerprint definitions database additions

Changes:

• If ftp is disabled in cPanel do not start pure-uploadscript
• New –options [E]. This option will match scripts that send out email using sendmail, exim or via SMTP. This option requires that –options [m] is also specified
• Improvement to –decode [file] variable detection
• Improvements to various eval() regex matches
• Exploit regex definitions database additions
• Exploit fingerprint definitions database additions

Changes:

• Fixed issue introduced in v1.26 that prevented ignoring of hdir and hfile options in an ignore file

Changes:

• Skip processing a home directory of / whe using –all
• Exploit regex definitions database additions
• Exploit fingerprint definitions database additions

New

Changes:

• Improved handling of –decode failures
• Exploit regex definitions database additions
• Exploit fingerprint definitions database additions

Changes:

• Improvements to –decode [file]
• Add the cxs command line to a report even if the scan report is empty
• Exploit regex definitions database additions
• Exploit fingerprint definitions database additions

Changes:

• Fixed a false-positive detection of c/c++ source files
• Added filename legend to View option UI in Other Files
• For single or multiple user scans, Symlinks within the homedir will now be ignored
• Removed [\;\|\`\\] regex checks from the [f] and [d] –options, as it appears to be of little value (you could always add back such a check using a similar regex entry in an xtra file)
• Modified hidden text in image file check to only report if the text is script code
• Exploit regex definitions database additions
• Exploit fingerprint definitions database additions

Changes:

• Fixed –options [D] output not going to a –report [file]
• Improvement to –decode [file] variable detection
• Exploit fingerprint definitions database additions

Changes:

• Added UID check to ensure updates are only performed by root (UID=0)
• New –options [D]. This is an experimental option that puts any PHP scripts containing an eval() function that decodes base64 and rot13 data through the (experimental) –decode [file] option during a scan. This will then highlight the decoded result if it hits any regex, fingerprint or virus scan matches
• Added eval(str_rot13 to –decode [file]
• Fixed –decode [file] not scanning final decoded result with regex definitions and fingerprints
• Improvements to –decode [file] detection and processing
• Modified pure-uploadscript init file to cope with multiple pure-ftpd pids on restart and to stop pure-ftpd more cleanly
• Exploit regex definitions database additions
• Exploit fingerprint definitions database additions