A zero-dependency, filesystem-level forensic scanner that monitors your Laravel codebase. Find hidden webshells, tampered configuration, and unexpected PHP payloads before they impact your users.
Static analysis tools audit your code configuration for vulnerability paths, but what happens when an attacker successfully bypasses your filters and uploads a backdoor?
Attackers quietly drop obfuscated PHP webshells inside public assets directories or storage
zones (e.g. public/icons/avatar.php) disguised as generic assets. Traditional WAFs
and error trackers miss them because they don't throw application exceptions.
By altering root or directory .htaccess rules, intruders can force servers to map
Python or Perl interpreters to custom MIME types, enabling them to execute raw terminal scripts
via normal HTTP requests.
Malicious actors routinely delete or truncate your application's .env
configurations. This silences monitoring endpoints, disables error-log tracking libraries, and
resets security keys, blinding your incident response.
.env disappearing..htaccess..env structural state and readability.Laravel Scalpel divides its work into individual checkers, each focusing on a distinct indicator of system compromise.
Flags PHP script extensions hidden inside static zones like public/,
storage/, and bootstrap/cache/.
non_php_zonesindex.php)Deconstructs all project PHP sources to identify obfuscated payloads, webshell triggers, and base64 payloads.
eval(base64_decode), gzinflateAudits Apache configurations for injected rules changing handler maps to trigger external scripts (Python, Perl).
AddHandler triggersCalculates cryptographic checksum hashes for codebases. Instantly reveals files that were altered, deleted, or injected.
baseline.json snapshots--fast option for deferred hashingValidates the local state of critical variables, guarding configuration blocks against deletion or tampering.
An honest overview of process isolation, potential attack surfaces, and production mitigations.
laravel-scalpel operates as a detection layer rather than a containment or sandbox layer. Because it is executed as a PHP Artisan command within your web-application workspace, it:
www-data).⚠️ Attacker Tampering Risk: A sufficiently skilled intruder who obtains raw PHP file execution could alter the scanner code, override configuration keys, or intercept report generation before results are dispatched.
Sign JSON scan outputs via HMAC-SHA256 to guarantee integrity. Any post-scan report modifications during transport are caught instantly by scalpel:verify.
Trigger scans externally via secure cron contexts running as distinct user profiles. Pair with read-only containers (Docker) to keep code zones immune to write modifications.
Manage rules, adjust obfuscation filters, declare safe directories, and trigger alerts through modern integrations.
<?php
return [
// Directories where PHP files should NOT exist
'non_php_zones' => [
'public',
'storage',
],
// Whitelisted PHP files within static directories
'structural_allowed_files' => [
'public/index.php',
],
// Subdirectories within static zones where PHP files are expected
'structural_allowed_directories' => [
'public/vendor',
'storage/framework/views',
'storage/framework/cache',
],
// Excluded from ALL scans
'excluded_paths' => [
'node_modules',
'.git',
],
// Excluded from content scanners only (still checked by baseline)
'content_scan_excluded_paths' => [
'vendor',
'bootstrap/cache',
],
// Target obfuscation regex checks
'obfuscation_patterns' => [
'eval_base64_decode' => true,
'eval_gzinflate' => true,
'eval_str_rot13' => true,
'eval_gzuncompress' => true,
'eval_gzdecode' => true,
'assert_dynamic' => true,
'variable_functions' => true,
'preg_replace_e' => true,
'long_encoded_string' => true,
],
'long_string_threshold' => 500,
'severity_threshold' => 'LOW',
// Use metadata-based fast scans; set true via --fast parameter or env override
'baseline_fast_scan' => env('SCALPEL_BASELINE_FAST_SCAN', false),
// Output HMAC signature signing settings
'signing' => [
'enabled' => env('SCALPEL_SIGNING_ENABLED', false),
'key' => env('SCALPEL_SIGNING_KEY'),
],
];name: Security Scan
on:
push:
branches: [main]
schedule:
- cron: '0 6 * * *' # Daily at 6 AM UTC
jobs:
scalpel-scan:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Setup PHP
uses: shivammathur/setup-php@v2
with:
php-version: '8.2'
- name: Install Dependencies
run: composer install --no-interaction --prefer-dist
- name: Run Scalpel Scan
run: php artisan scalpel:scan --format=json
- name: Run Baseline Diff
run: php artisan scalpel:diff --format=json# Pair laravel-scalpel with n8n-bastion to receive instant Telegram notifications
# when a CRITICAL vulnerability or filesystem alteration occurs on your production VPS.
# Example bash hook triggered by cron on your VPS server:
RESULT=$(php artisan scalpel:scan --format=json)
EXIT_CODE=$?
if [ $EXIT_CODE -ne 0 ]; then
# Send payload to n8n webhook
curl -X POST https://your-n8n-bastion-domain.com/webhook/scalpel-alert \
-H "Content-Type: application/json" \
-d "{\"status\": \"compromised\", \"findings\": $RESULT}"
fiIntegrate Laravel Scalpel into your codebase in less than a minute.
Pull the scanner package into your project vendor using Composer.
composer require hryagstn/laravel-scalpel
Generate your config asset template file config/scalpel.php.
php artisan vendor:publish --tag=scalpel-config
Audit your directories or create baseline snapshots of your codebase.
php artisan scalpel:scan
Combine filesystem scans with other open-source tooling from the same developer for maximum visibility.
A self-hosted open-source server security monitor template designed for VPS administrators. Combined with Laravel Scalpel, it watches server performance metrics, process counts, and forwards urgent security threat updates directly to your Telegram chat.