Laravel Scalpel: Scan for Filesystem Intrusion Evidence | Mohamed Said [ ![Mohamed Said](https://cdn.msaied.com/01KT78WE565VEMM3PSNQAAB0MH.png) Mohamed Said Laravel Backend Engineer ](https://msaied.com) [ Home ](https://msaied.com) [ Projects ](https://msaied.com/projects) [ Articles ](https://msaied.com/articles) [ Certificates ](https://msaied.com/certificates) [ Contact ](https://msaied.com#contact-section) [ ](https://github.com/EG-Mohamed) [ Home ](https://msaied.com) [ Projects ](https://msaied.com/projects) [ Articles ](https://msaied.com/articles) [ Certificates ](https://msaied.com/certificates) [ Contact ](https://msaied.com#contact-section) [ home ](https://msaied.com) [ articles ](https://msaied.com/articles) Laravel Scalpel: Filesystem Intrusion Evidence Scanner for Laravel Apps On this page 1. [ What Is Laravel Scalpel? ](#what-is-laravel-scalpel) 2. [ The Six Built-in Scanners ](#the-six-built-in-scanners) 3. [ Structural Scanner ](#structural-scanner) 4. [ Obfuscated-Code Scanner ](#obfuscated-code-scanner) 5. [ .htaccess Scanner ](#htaccess-scanner) 6. [ .user.ini Scanner ](#userini-scanner) 7. [ Environment Scanner ](#environment-scanner) 8. [ Baseline Diff Scanner ](#baseline-diff-scanner) 9. [ Creating and Using a Baseline ](#creating-and-using-a-baseline) 10. [ Fast Mode vs. Strict Mode ](#fast-mode-vs-strict-mode) 11. [ Signed Baselines ](#signed-baselines) 12. [ Running Selective Scans and CI Integration ](#running-selective-scans-and-ci-integration) 13. [ Installation ](#installation) 14. [ Key Takeaways ](#key-takeaways) ![Laravel Scalpel: Filesystem Intrusion Evidence Scanner for Laravel Apps](https://cdn.msaied.com/675/406b0f123858892b97052502c0020eac.png) [ Laravel ](https://msaied.com/articles?category=laravel) [ Composer Pacakge ](https://msaied.com/articles?category=composer-pacakge) #security #laravel #php #intrusion-detection #filesystem #composer-package Laravel Scalpel: Filesystem Intrusion Evidence Scanner for Laravel Apps ========================================================================= 17 Sep 2026 4 min read ![Mohamed Said](https://cdn.msaied.com/01M22N44A70A5MC2S599JP0MPH.webp) Mohamed Said Table of contents 14 sections 1. [ 01 What Is Laravel Scalpel? ](#what-is-laravel-scalpel) 2. [ 02 The Six Built-in Scanners ](#the-six-built-in-scanners) 3. [ 03 Structural Scanner ](#structural-scanner) 4. [ 04 Obfuscated-Code Scanner ](#obfuscated-code-scanner) 5. [ 05 .htaccess Scanner ](#htaccess-scanner) 6. [ 06 .user.ini Scanner ](#userini-scanner) 7. [ 07 Environment Scanner ](#environment-scanner) 8. [ 08 Baseline Diff Scanner ](#baseline-diff-scanner) 9. [ 09 Creating and Using a Baseline ](#creating-and-using-a-baseline) 10. [ 10 Fast Mode vs. Strict Mode ](#fast-mode-vs-strict-mode) 11. [ 11 Signed Baselines ](#signed-baselines) 12. [ 12 Running Selective Scans and CI Integration ](#running-selective-scans-and-ci-integration) 13. [ 13 Installation ](#installation) 14. [ 14 Key Takeaways ](#key-takeaways) What Is Laravel Scalpel? ------------------------ [Laravel Scalpel](https://github.com/hryagstn/laravel-scalpel) is an intrusion evidence scanner built by Harry Agustiana. Unlike tools such as Ward or Checkpoint—which audit source code and dependencies for known vulnerabilities—Scalpel focuses on a different question: **have files in your deployed application already been added, changed, or removed?** It runs as a set of Artisan commands inside a Laravel application and requires PHP 8.2+ with Laravel 10 through 13. The Six Built-in Scanners ------------------------- Running `php artisan scalpel:scan` executes six scanners by default. ### Structural Scanner Looks for executable PHP files in directories where PHP should not appear—`public/` and `storage/` by default. It catches `.php`, `.phtml`, `.pht`, `.phar`, and double-extension files such as `shell.php.jpg`. Known-good paths like `public/index.php` and compiled views are allow-listed by default. ### Obfuscated-Code Scanner Checks PHP files for common backdoor patterns: `eval(base64_decode(...))`, compressed payload execution, dynamic function calls, direct evaluation of request input, and long encoded strings. Individual patterns can be disabled in `config/scalpel.php` if legitimate code triggers a false positive. ### .htaccess Scanner Flags handler and MIME-type mappings that allow the web server to execute Python, Perl, or CGI scripts, as well as `Options +ExecCGI`, external-URL rewrite rules, and directives like `auto_prepend_file`. ### .user.ini Scanner Reports per-directory PHP directives including `auto_prepend_file`, `auto_append_file`, `include_path`, and `disable_functions`—all of which an attacker can exploit to run hidden code on every request. ### Environment Scanner Checks for a missing, empty, or world-readable `.env` file, a `.env` placed under `public/`, an empty `APP_KEY`, key mismatches against `.env.example`, and `APP_DEBUG=true` in production. ### Baseline Diff Scanner Compares current files against a saved SHA-256 snapshot and reports added, modified, and deleted files. Creating and Using a Baseline ----------------------------- ```bash # Record a trusted snapshot php artisan scalpel:baseline # Compare current files against it php artisan scalpel:diff ``` Create the baseline only when the application is in a state you trust. After each deployment, the recommended workflow is: ```bash php artisan optimize php artisan scalpel:baseline --force ``` The `vendor/` directory is excluded from content scans but included in baseline comparisons, so a file injected into an installed package still appears in the diff. ### Fast Mode vs. Strict Mode By default, Scalpel hashes every file on each run (strict mode). The `--fast` flag skips re-hashing when file size and modification time are unchanged—useful for large codebases, but it can miss a tampered file if an attacker preserves both attributes. ### Signed Baselines Set `SCALPEL_SIGNING_ENABLED=true` and provide a dedicated `SCALPEL_SIGNING_KEY` (not your `APP_KEY`) to HMAC-sign baselines and JSON reports. The diff command verifies the signature before use and raises a `CRITICAL` finding if it is invalid or missing. Running Selective Scans and CI Integration ------------------------------------------ ```bash # Run only specific scanners php artisan scalpel:scan --only=structural,obfuscated # Output SARIF for CI and fail on MEDIUM or higher php artisan scalpel:scan --format=sarif --fail-on=MEDIUM ``` Exit codes: `0` = clean, `1` = finding at or above `--fail-on` severity, `2` = findings below threshold or incomplete scan. After each scan or diff, Scalpel dispatches a `ScanFinished` event containing findings, command name, and duration in milliseconds—making it straightforward to route alerts to Slack, email, or a webhook without parsing CLI output. **Note for CI pipelines:** `php artisan optimize` compiles views under `storage/framework/views`. The obfuscated-code scanner reads those generated files and can produce many false positives. Add `storage/framework/views` to `content_scan_excluded_paths` or run `optimize:clear` before scanning. Installation ------------ ```bash composer require hryagstn/laravel-scalpel php artisan vendor:publish --tag=scalpel-config ``` Key Takeaways ------------- - Scalpel detects **post-compromise evidence**; it is not a firewall or WAF. - Six scanners cover structural anomalies, obfuscated code, `.htaccess`/`.user.ini` tampering, environment issues, and baseline drift. - Signed baselines add tamper detection but cannot protect against an attacker who can read the signing key. - CI-friendly output formats (JSON, SARIF, GitHub Actions annotations) and configurable `--fail-on` severity make it easy to integrate into deployment pipelines. - The scanner runs with the same permissions as the application—use external scan triggers and read-only code directories for stronger guarantees. [Source: Laravel News — Laravel Scalpel Scans for Filesystem Intrusion Evidence](https://laravel-news.com/laravel-scalpel) Found this useful? [ ](https://twitter.com/intent/tweet?url=https%3A%2F%2Fmsaied.com%2Farticles%2Flaravel-scalpel-filesystem-intrusion-evidence-scanner-for-laravel-apps&text=Laravel+Scalpel%3A+Filesystem+Intrusion+Evidence+Scanner+for+Laravel+Apps) [ ](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fmsaied.com%2Farticles%2Flaravel-scalpel-filesystem-intrusion-evidence-scanner-for-laravel-apps) Frequently Asked Questions ---------------------------- 3 questions Q01 How is Laravel Scalpel different from other Laravel security tools like Ward or Checkpoint? Ward and Checkpoint inspect source code, configuration, and dependencies for known vulnerabilities before deployment. Scalpel is a post-compromise tool: it scans a deployed application's filesystem for evidence that files have already been added, changed, or removed by an attacker. Q02 When should I create a Scalpel baseline, and how do I keep it current? Create the baseline only when the application is in a state you trust. After every deployment, run `php artisan optimize` followed by `php artisan scalpel:baseline --force` to replace the old snapshot. Until a baseline exists, scans will report a MEDIUM finding prompting you to create one. Q03 Can Scalpel produce false positives from Laravel's compiled views? Yes. Running `php artisan optimize` compiles views under `storage/framework/views`, and the obfuscated-code scanner reads those files, potentially generating many MEDIUM and HIGH findings. To avoid this, add `storage/framework/views` to `content_scan_excluded_paths` in `config/scalpel.php`, or run `php artisan optimize:clear` before scanning. Continue reading More Articles --------------- [ View all ](https://msaied.com/articles) [ ![Inertia DevTools Now Available for Firefox](https://cdn.msaied.com/674/445325ab535802b1b68d3adc3ada5cd0.png) Inertia.js DevTools Firefox ### Inertia DevTools Now Available for Firefox Inertia DevTools has landed on Firefox with full feature parity to the Chrome extension. Firefox users can now... ![Mohamed Said](https://cdn.msaied.com/01M22N44A70A5MC2S599JP0MPH.webp) Mohamed Said 17 Sep 2026 3 min read Read ](https://msaied.com/articles/inertia-devtools-now-available-for-firefox) [ ![Mercure Broadcasting in Laravel 13.32](https://cdn.msaied.com/672/f3bf9ae116410789061208a12ebf2682.png) Laravel Broadcasting Mercure ### Mercure Broadcasting in Laravel 13.32 Laravel 13.32 ships a native Mercure broadcast driver using SSE, new copyToDisk() and moveToDisk() filesystem... ![Mohamed Said](https://cdn.msaied.com/01M22N44A70A5MC2S599JP0MPH.webp) Mohamed Said 16 Sep 2026 3 min read Read ](https://msaied.com/articles/mercure-broadcasting-in-laravel-1332) [ ![Laravel Vet: Review Composer Packages Before They Install](https://cdn.msaied.com/673/b28242efe2234ba0270b986e508570d2.png) Laravel Composer Security ### Laravel Vet: Review Composer Packages Before They Install Laravel Vet is a new official Composer plugin that intercepts every `composer update`, shows you the code diff... ![Mohamed Said](https://cdn.msaied.com/01M22N44A70A5MC2S599JP0MPH.webp) Mohamed Said 15 Sep 2026 4 min read Read ](https://msaied.com/articles/laravel-vet-review-composer-packages-before-they-install) [ ![Mohamed Said](https://cdn.msaied.com/01KT78WE565VEMM3PSNQAAB0MH.png) Mohamed Said Laravel Backend Engineer ](https://msaied.com)Senior Backend Engineer specializing in Laravel, scalable SaaS platforms, APIs, and cloud infrastructure. I build secure, high-performance web applications that help businesses grow. Explore - [Home](https://msaied.com) - [Projects](https://msaied.com/projects) - [Articles](https://msaied.com/articles) - [Certificates](https://msaied.com/certificates) - [Contact](https://msaied.com#contact-section) Connect - [ hello@msaied.com ](mailto:hello@msaied.com) - [ +20 109 461 9204 ](tel:+201094619204) © 2026 Mohamed Said. All rights reserved. [ ](https://github.com/EG-Mohamed) [ ](https://www.linkedin.com/in/msaiedm/) [ ](https://wa.me/201094619204) [ ](mailto:hello@msaied.com) [ ](https://drive.google.com/file/u/0/d/1MF20IPRJyzfy32mhEutjL5EpSls0w2Q8/view)