How to find files with a long first line

filesfindwc

currently I have a problem with a server. One user who is hosting a lot of sites got hacked and some of his php files were modified. Now I want to get a list of the infected files and also want to check if he cleaned the whole mess.

The common thing between the infected files is that the first line is very long. So I'd like to find every php file on the server that has a min length of 1000 chars.

Well, I can find all php files with "find" and get with "head -n 1" the first line and count the chars with "wc -m".

But how can I combine it together?

Best Answer

You can do it with just find and awk:

find . -type f -name '*.php' -size +1000c -exec awk '
    FNR > 1 {nextfile}
    length >= 1000 {print FILENAME}' {} +

The awk script skips to next file after the first line of every file. It prints the filename of the current file if the current line is >= 1000 characters long.

Related Question