# Tools

##### **PHP deobfuscators**:

###### *Online*:
* FOPO PHP Deobfuscator [ver. 0.1](https://glot.io/snippets/ee5mzg3zf1) | [ver. 0.2](https://glot.io/snippets/efruafhnez)
* [Quttera's PHP decoder](https://malwaredecoder.quttera.com/)
* [unPHP](https://www.unphp.net/)

###### *Offline*:
* [PHP Converter](http://www.kahusecurity.com/downloads/PHPConverter_v0.3.7z)
* [PHP Script Decoder](http://www.kahusecurity.com/downloads/PHPScriptDecoder_v0.1.7z)

*Note*: check out KahuSecurity's site [directly](http://www.kahusecurity.com) for latest versions of these tools.


##### **PHP beautifiers**:
* [Dan's PHP beautify](https://www.cleancss.com/php-beautify/)
* [CyberChef Generic Beautify](https://gchq.github.io/CyberChef/#recipe=Generic_Code_Beautify())


##### **PHP testers**:

###### *Online*:
* [PHP Sandbox / PHP Online](https://onlinephp.io/)

###### *Offline*:
* [EasyPHP](http://www.easyphp.org/)
* [XAMPP](https://www.apachefriends.org/index.html)


## Notes
* Always investigate malware in a secure environment. This means: seperately from your network and in a virtual machine!
* Some backdoors may be backdoored *(yes, really)*. Don't ever use this for any malicious purposes.
