A zero-dependency, filesystem-level forensic scanner that monitors your Laravel codebase. Find hidden webshells, tampered configuration, and unexpected PHP payloads before they impact your users.
Static analysis tools audit your code configuration for vulnerability paths, but what happens when an attacker successfully bypasses your filters and uploads a backdoor?
Attackers quietly drop obfuscated PHP webshells inside public assets directories or storage
zones (e.g. public/icons/avatar.php) disguised as generic assets. Traditional WAFs
and error trackers miss them because they don't throw application exceptions.
By altering root or directory .htaccess rules, intruders can force servers to map
Python or Perl interpreters to custom MIME types, enabling them to execute raw terminal scripts
via normal HTTP requests.
Malicious actors routinely delete or truncate your application's .env
configurations. This silences monitoring endpoints, disables error-log tracking libraries, and
resets security keys, blinding your incident response.
.env disappearing..htaccess..env structural state and readability.Laravel Scalpel divides its work into individual checkers, each focusing on a distinct indicator of system compromise.
Flags PHP script extensions hidden inside static zones like public/,
storage/, and bootstrap/cache/.
non_php_zonesindex.php)Deconstructs all project PHP sources to identify obfuscated payloads, webshell triggers, and base64 payloads.
eval(base64_decode), gzinflateAudits Apache configurations for injected rules changing handler maps to trigger external scripts (Python, Perl).
AddHandler triggersCalculates cryptographic checksum hashes for codebases. Instantly reveals files that were altered, deleted, or injected.
baseline.json snapshotsValidates the local state of critical variables, guarding configuration blocks against deletion or tampering.
Manage rules, adjust obfuscation filters, declare safe directories, and trigger alerts through modern integrations.
<?php
return [
// Directories where PHP files should not exist
'non_php_zones' => [
'public',
'storage',
'bootstrap/cache',
],
// Whitelisted PHP files within static directories
'structural_allowed_files' => [
'public/index.php',
],
// Excluded from ALL scans
'excluded_paths' => [
'vendor',
'node_modules',
'.git',
],
// Target obfuscation regex checks
'obfuscation_patterns' => [
'eval_base64_decode' => true,
'eval_gzinflate' => true,
'eval_str_rot13' => true,
'eval_gzuncompress' => true,
'assert_dynamic' => true,
'long_encoded_string' => true,
],
'long_string_threshold' => 500,
'severity_threshold' => 'LOW',
];name: Security Scan
on:
push:
branches: [main]
schedule:
- cron: '0 6 * * *' # Daily at 6 AM UTC
jobs:
scalpel-scan:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Setup PHP
uses: shivammathur/setup-php@v2
with:
php-version: '8.2'
- name: Install Dependencies
run: composer install --no-interaction --prefer-dist
- name: Run Scalpel Scan
run: php artisan scalpel:scan --format=json
- name: Run Baseline Diff
run: php artisan scalpel:diff --format=json# Pair laravel-scalpel with n8n-bastion to receive instant Telegram notifications
# when a CRITICAL vulnerability or filesystem alteration occurs on your production VPS.
# Example bash hook triggered by cron on your VPS server:
RESULT=$(php artisan scalpel:scan --format=json)
EXIT_CODE=$?
if [ $EXIT_CODE -ne 0 ]; then
# Send payload to n8n webhook
curl -X POST https://your-n8n-bastion-domain.com/webhook/scalpel-alert \
-H "Content-Type: application/json" \
-d "{\"status\": \"compromised\", \"findings\": $RESULT}"
fiIntegrate Laravel Scalpel into your codebase in less than a minute.
Pull the scanner package into your project vendor using Composer.
composer require hryagstn/laravel-scalpel
Generate your config asset template file config/scalpel.php.
php artisan vendor:publish --tag=scalpel-config
Audit your directories or create baseline snapshots of your codebase.
php artisan scalpel:scan
Combine filesystem scans with other open-source tooling from the same developer for maximum visibility.
A self-hosted open-source server security monitor template designed for VPS administrators. Combined with Laravel Scalpel, it watches server performance metrics, process counts, and forwards urgent security threat updates directly to your Telegram chat.