Monday, August 12, 2013

Inverse diff - repeated malicious javascript code

I was looking into some pages for malicious javascript and needed to figure out between all the instances we found online how many where basically the same malicious code and how many were unique.

If you have been playing with linux for a while you will probably have run into diff, a nice little command to figure out the differences between files. So what I actually needed is the opposite of the "classic" diff. After a little search online I found the syntax

 diff --unchanged-group-format=%= --new-group-format= --old-group-format= file1 file2

To make this a bit visual:
file1 contains:
123
abc
def
999

file2 contains:
123
def
ddd
lalala

and the output will be:
123
def

No comments: