# mysql-scanner

MySQL database malware scanner for WordPress and generic schemas.

## Purpose

Detect hacked content and malware in MySQL databases by scanning text columns for:
- Base64 encoded payloads
- PHP dangerous functions (eval, exec, system, etc.)
- HTML/JS injection (script tags, iframes, event handlers)
- Obfuscation patterns
- Suspicious comment signatures

## Features

- **Schema-agnostic**: Analyzes any database structure automatically
- **WordPress-aware**: Prioritizes common WordPress tables (wp_posts, wp_options, etc.)
- **Pattern library**: Extensible detection patterns
- **Contextual reports**: Shows table, column, row ID, and offending snippets
- **Risk levels**: High/Medium/Low classification

## Installation

```bash
cd tools/go/mysql-scanner
go build -o mysql-scanner
```

## Usage

```bash
# Scan WordPress database
./mysql-scanner --host localhost --user wp_user --password secret --db wordpress

# Scan with custom port and pattern filters
./mysql-scanner --host localhost --port 3307 --user user --db mydb --patterns eval,base64,script

# Output JSON for automated processing
./mysql-scanner --host localhost --user user --db mydb --json --output scan-results.json
```

## Environment Variables

```bash
DB_HOST=localhost
DB_PORT=3306
DB_USER=username
DB_PASSWORD=secret
DB_NAME=database
```

## Detection Patterns

### PHP Malware
- `eval()`, `assert()`, `create_function()`
- `exec()`, `system()`, `passthru()`, `shell_exec()`
- `base64_decode()`, `gzinflate()`, `str_rot13()`
- `preg_replace()` with `/e` modifier (deprecated but dangerous)

### Web Shell Patterns
- `$_GET`, `$_POST`, `$_REQUEST` with eval
- `error_reporting(0)` followed by obfuscation
- Variable function calls (`$func()`, `$a($b)`)

### HTML/JS Injection
- `<script>...</script>` tags
- `<iframe>` tags (especially with hidden attributes)
- Event handlers: `onerror=`, `onload=`, `onclick=`
- `javascript:` protocol in attributes

### Base64 Payloads
- Long base64 strings (>200 chars)
- Base64 followed by decode/eval patterns
- Double-encoded base64

## Architecture

1. **Connection**: MySQL driver with configurable auth
2. **Schema Discovery**: Queries `information_schema` for tables and text columns
3. **Row Scanning**: Iterates through all rows, extracts text content
4. **Pattern Matching**: Runs detection patterns against each text field
5. **Reporting**: Aggregates findings with context and risk levels

## Security Notes

- This tool requires database credentials with SELECT access
- Recommended for incident response and periodic security audits
- Can be integrated into CI/CD for automated scanning
- **Never expose scan reports publicly** - they may contain sensitive data

## Future Enhancements

- Heuristic scoring for combined risk factors
- YARA rule support for advanced signatures
- Automatic quarantine/sanitization suggestions
- Real-time monitoring mode with change detection
- Integration with WordPress security plugins
