<?php
$rootDir = './'; // Scan from current directory
$log = [];

function isSuspicious($content, $file) {
    $patterns = [
        '/\$_(POST|GET|REQUEST)\s*\[\s*[\'"]?(path|file|dir|data)[\'"]?\s*\]/i',
        '/file_get_contents\s*\(\s*\$_(POST|GET|REQUEST)\[.*\]\s*\)/i',
        '/file_put_contents\s*\(\s*\$_(POST|GET|REQUEST)\[.*\]\s*,/i',
        '/fopen\s*\(\s*\$_(POST|GET|REQUEST)\[.*\]/i',
        '/chmod\s*\(\s*\$_(POST|GET|REQUEST)\[.*\]/i',
        '/eval\s*\(\s*\$_(POST|GET|REQUEST)\[.*\]/i',
        '/touch\s*\(\s*\$_(POST|GET|REQUEST)\[.*\]/i',
    ];

    foreach ($patterns as $pattern) {
        if (preg_match($pattern, $content)) {
            return true;
        }
    }
    return false;
}

$rii = new RecursiveIteratorIterator(new RecursiveDirectoryIterator($rootDir));
foreach ($rii as $file) {
    if ($file->isDir()) continue;

    $ext = pathinfo($file->getFilename(), PATHINFO_EXTENSION);
    if (in_array($ext, ['php'])) {
        $content = file_get_contents($file->getPathname());
        if (isSuspicious($content, $file->getPathname())) {
            $log[] = $file->getPathname();
        }
    }
}

if (empty($log)) {
    echo "✅ No suspicious PHP files found.\n";
} else {
    echo "🚨 Suspicious behavior detected in:\n";
    foreach ($log as $filepath) {
        echo " - $filepath\n";
    }
}
?>
