2

Here is my question:

where I've asked about malicious PHP script which I've found on my hacked server and its method of action. In other words what harm it can potentially do.

It was highly up-voted and gained some interest (>2k views in 1 day).

Why this was closed as off-topic? I thought analysing scripts which were used for hacking the sites suppose to be related to security as part of its code analysis and what harm it can do? So further users can benefit from it?

2 Answers 2

Reset to default
7

Code analysis isn't generally on topic here. Because there are any number of obfuscated scripts you could dedicate a website to this topic.

But that website is not Security Stack Exchange. Far more relevant to us is how we ensure that detection and blocking systems are configured; layered defences; managed anti-malware and antivirus services etc.

5
  • 6
    To clarify: questions ABOUT code analysis ARE on topic here, very much so. It's when the question is asking FOR US TO DO the analysis, that is off topic.
    – AviD Mod
    Apr 17, 2015 at 7:51
  • 2
    That is also not strictly a security question, even though it's roots are in security. It's a "what does this code do" question.
    – AviD Mod
    Apr 17, 2015 at 7:51
  • Could we add codereview.stackexchange.com to the Migration list maybe?
    – Steve Dodier-Lazaro
    May 23, 2015 at 12:14
  • From discussions previously, it is unlikely. We get hardly any migrations that direction.
    – Rory Alsop Mod
    May 23, 2015 at 12:19
  • 1
    I am not sure that such questions are migrable to CodeReview SE. As stated on their topic page, they concentrate on working code and questions requesting to understand code snippets are explicitly out of topic. I do not know if it would be interesting to redirect to some post explaining the basis how to analyze oneself? Such kind of answer may answer some need regarding PHP code (some sort of learn to fish instead of giving a fish).
    – WhiteWinterWolf
    May 23, 2015 at 21:35
8

Questions about malicious scripts can be on-topic. But that is not an accurate description of your question.

“Here's a dump of obfuscated code, what does it do?” is not suitable for Security.SE, not because it's off-topic, but because it's *unsuitable for Stack Exchange. Unfortunately, the classification of close reasons on Stack Exchange tends to lump close reasons under off-topic, even when the reason for closing has to do with the nature of the question rather than its topic.

The problem with your question is that you give a code dump and ask what it does. This requires a thorough analysis of the code and of the setting where you found it. This is far too much work for a Stack Exchange answer. Asking about the implications of a particular line (after you've done the fundamental reverse engineering work to deobfuscate the code) would be fine.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .