check_websites

I recently had the chance to try out check_websites, a simple virus scanner for websites that is designed to check a document root directory for files with the .js extension and for codewords that may indicate defacement or SQL injection. Specifically, the script checks a document_root_directory for files with the /[a-zA-Z0-9].js expression and for codewords that are listed in the file check_websites.words, which may be a hint of assive_hack_defacement (SQL injection) that occurred during the last few weeks of Apr/May 2008.

One thing I appreciate about check_websites is that it is made to run as a cronjob, without displaying output on the screen. Instead, the script generates a logfile and sends output via email.

If you want to check SQL databases, you will need to create a dump.sql and check this file. The dump should be included within the $document_root, and you should chmod 700 that directory and 400 all files included. It is important to note that .sql_files are scanned as well as all files with endings listed in $htdocs_format (*.*htm* are checked by default).

In order to implement this, I followed the instructions in run_before_template.sh/run_after_template.sh and created a mysql_dump, which copies the daily dump somewhere under $document_root (/srv/www/htdocs/mysqlcheck). The script also extracts the bzip2_file to a sql file and searches this file for SQL injections. With this daily SQL dump of all databases, you can have a daily check within all SQL databases and tables.

Overall, I found check_websites to be a useful and efficient tool for checking websites for viruses and potential security vulnerabilities. The ability to run it as a cronjob and receive output via email was especially helpful. I would definitely recommend it to others looking for a simple and effective virus scanner for their websites.