|
do a search for things like 'exec' or 'base64_decode'
ie
grep -r 'exec' ./
in ur root dir.
anything that has that and things like base64_decode() is often a hacked script. sometimes searching for file_get_contents or curl() will find stuff too. if it is all grouped together and not clear/tidy code make sure to give it a good look and work out what its doing.
|