analyze-showcase

A deliberately-vulnerable PHP + WordPress tree that trips all 20 analyzers in ephpm analyze. It's a test corpus — every analyzer has something to catch in here.

⚠️ DO NOT DEPLOY THIS

This is intentionally insecure. It contains real (if trivial) command injection, eval, a mock webshell, obfuscated payloads, hardcoded credentials, a malicious Composer install hook, a known-vulnerable dependency, and a known-vulnerable WordPress plugin — on purpose, as bait for the analyzers. It is a test fixture only. Never put it on a public server.

Run it

$ ephpm analyze .
…
verdict: deny
  - hard deny: critical finding wp-vuln/contact-form-7/CVE-2020-35489
  - confirmed score >= deny threshold
$ echo $?
3

The single critical finding (a known-exploitable Contact Form 7 version) hard-denies the whole run, regardless of everything else — that's the fail-closed deploy gate doing its job.

📊 Visual walkthrough of the analyzer output: https://claude.ai/code/artifact/fe92687c-dd2c-4872-9320-2b79a78f6e4b

What each analyzer catches here

Analyzer	Kind	Bait	Catches
wp-vuln	native	wp-content/plugins/contact-form-7/ (v5.3.1)	critical — CVE-2020-35489 (unrestricted file upload)
composer-audit	external	composer.json (guzzle 6.5.0)	known dependency advisories
composer-scripts	native	composer.json scripts block	pipe-to-shell install hook (curl … | sh) + inline eval
progpilot	external	public/index.php, webshell.php	taint → SQLi / XSS / command-injection / eval
psalm-taint	external	same	TaintedShell / TaintedEval / TaintedHtml
semgrep-php	external	same	p/php security patterns
dangerous-sinks	native	eval/system/assert calls	dangerous sinks (suspected — token scan)
opcode-scan	engine	same calls	the same sinks, confirmed, from compiled opcodes
malware-yara	external	webshell.php (c99shell string)	webshell signature match
clamav	external	webshell.php	ClamAV malware/webshell signature (needs clamscan)
obfuscation-scan	native	obfuscated.php	eval(base64_decode()), eval($_POST), preg_replace /e, dynamic call, long blob
secrets-scan	native	config/secrets.php	AWS key id + high-entropy password/secret assignments
writable-exec	native	wp-content/uploads/2024/invoice.php	executable PHP in an upload dir (dropped-webshell by location)
weak-crypto	native	src/Crypto.php	TLS verify disabled, ECB, mcrypt, md5/sha1, insecure random
phpstan	external	public/index.php, src/Widget.php	type errors, undefined vars, dead code
php-lint	engine	syntax-error/broken.php	syntax error (php -l, in-process)
phpcs	external	src/Widget.php	coding-standard violations
phpmd	external	src/Widget.php	unused vars, short names, naming
rector	external	whole tree	refactor suggestions (strict --dry-run)
suppression-scan	native	src/Widget.php (// nosemgrep)	inline suppression attempts (never honored)

Layout

public/index.php     SQLi, XSS, command-injection, eval, a type error
src/Widget.php       code smells, style violations, suppression markers
src/Crypto.php       weak-crypto: md5/sha1, ECB, mcrypt, TLS verify off
webshell.php         mock webshell (system($_REQUEST), c99shell string)
obfuscated.php       eval-of-decode, eval-of-request, preg /e, dynamic call, blob
config/secrets.php   hardcoded AWS key + high-entropy secrets
wp-content/uploads/  a .php dropped where only data belongs (writable-exec)
syntax-error/        broken.php — the php-lint bait
composer.json        vulnerable guzzle + a malicious install-script hook
wp-content/…         Contact Form 7 5.3.1 (vulnerable plugin)
wp-includes/…        old WordPress core version
fixtures/            webshell.yar (YARA rules) + wordfence-feed.json (wp-vuln feed)
.ephpm-analyze.yml   enables all 20 analyzers

What runs out of the box

Ten analyzers need nothing but the ephpm binary and fire immediately: dangerous-sinks, suppression-scan, obfuscation-scan, secrets-scan, writable-exec, composer-scripts, weak-crypto (all native), wp-vuln (the feed ships in fixtures/), plus opcode-scan and php-lint on a PHP-linked release build.

The rest wrap an external tool and skip gracefully when it isn't installed:

• composer-audit → composer
• semgrep-php → semgrep; malware-yara → yara; clamav → clamscan
• phpstan/psalm/phpcs/phpmd/rector/progpilot → install via composer (psalm-taint needs a composer install first, for autoloading)

The wp-vuln feed in fixtures/ is a tiny fixture; point wp_vuln_feed at a real Wordfence Intelligence feed for production use.