dtrace-infiltrate

Apache Javascript Injector
Hook open, looking for .htm in the filename.
Store the fd in htmlfd[] array for other probes.
Close removes fd obviously…
syscall::open*:return
/execname == "httpd" && (strstr(fds[arg1].fi_pathname+2,".htm") != 0) /
{
/* store pid for read */
htmlfd[arg1] = 1;
printf("[+] Adding open for: %s returned fd: %i\n",fds[arg1].fi_pathname
+2,arg1);
}