centos上webshell的查找方法

webshell的一些关键字（eval,shell_exec,passthru,popen,system,cmd,szcmd,post,phpspy）查找方法如下：

find /var/webroot -name “*.php” |xargs grep “eval” |more
find /var/webroot -name “*.php” |xargs grep “shell_exec” |more
find /var/webroot -name “*.php” |xargs grep “passthru” |more

find /var/webroot -name “*.jsp” |xargs grep “popen” |more

find /home -name “*.php”|xargs grep “fsockopen”|more >test.log