Fact-checked by Grok 2 weeks ago

Web shell

A web shell is a malicious script that can be uploaded to a to enable of the machine, allowing attackers to execute arbitrary system commands via HTTP or requests. These scripts are typically written in web scripting languages such as , , , , or , and they function by processing input from an attacker and returning the output of executed commands, effectively providing persistent backdoor access to the compromised server. Web shells are often deployed through vulnerabilities in web applications, such as unrestricted file uploads, , or , and can target both internet-facing and internal servers. Once installed, web shells grant attackers elevated privileges based on the web server's permissions, enabling activities like , further deployment, , and lateral movement across networks. They are favored by (APT) actors and cybercriminals for their simplicity, ease of , and ability to blend malicious traffic with legitimate web activity, making detection challenging. Common examples include the China Chopper, WSO, , and B374K shells, which are compact and multifunctional tools often modified to evade security measures. The risks posed by web shells extend to , where they facilitate long-term persistence and serve as command-and-control mechanisms for larger cyberattacks, underscoring the need for robust practices.

Introduction

Definition and Purpose

A is a malicious or program that is uploaded to a compromised , enabling attackers to execute arbitrary system commands, manage files, and gain over the host via HTTP or requests. This functionality allows the web shell to serve as a backdoor, providing unauthorized access that blends with normal to evade traditional network-based intrusion detection systems. The primary purpose of a is to establish persistent to a compromised after initial intrusion, facilitating activities such as , lateral movement within networks, uploading additional , and maintaining command-and-control operations. Unlike legitimate remote tools, which typically incorporate robust mechanisms and , web shells operate covertly with minimal or no built-in , relying on to remain undetected while attackers relay commands through interfaces. They are often delivered through application vulnerabilities, such as or file upload flaws, to ensure ongoing exploitation without requiring direct network ports. Key characteristics of web shells include their implementation as backdoors accessible via standard web browsers or custom clients, commonly written in server-side scripting languages like PHP, ASP, ASPX, JSP, or ColdFusion to exploit common web environments. For enhanced stealth, they are designed to be minimal in size—often under 1 KB, as seen in variants like the ASPX version of China Chopper at 73 bytes—to reduce forensic footprints and mimic benign files. In contrast to self-propagating malware such as viruses or worms, web shells do not replicate independently and instead require manual upload or exploitation-based placement on the target server.

Historical Development

Web shells emerged in the early as web applications proliferated and vulnerabilities in server-side scripting languages became common exploitation targets, enabling attackers to malicious scripts for persistent remote access during defacements and data breaches. Their popularity surged in the mid- alongside the widespread adoption of for dynamic web content, with tools like the C99 shell—a compact backdoor supporting file management and command execution—appearing around 2007 and becoming a staple in toolkits for server compromise. Post-2010, web shells integrated into advanced persistent threat (APT) operations, as nation-state actors and groups leveraged them for stealthy command-and-control in targeted intrusions, exemplified by the lightweight China Chopper shell first observed in 2012 and later deployed in high-profile compromises like the 2021 attacks. Following increased detection efforts around , attackers evolved techniques, such as embedding malicious code in image metadata, using encoding, and employing opaque predicates to evade signature-based , transforming basic scripts into harder-to-detect variants. Over time, web shells advanced from rudimentary command executors to sophisticated multi-featured tools incorporating for traffic camouflage, anti-forensic measures like log manipulation, and modular designs for extended persistence, as seen in the 2021 IISpy backdoor that interfered with server logging to support long-term . Nation-state influence grew prominent, with groups like Russia's deploying custom web shells in 2025 cyberattacks on energy and sectors, using living-off-the-land techniques to exfiltrate data undetected. By 2025, trends included AI-assisted generation of polymorphic shells to automate evasion and integration with zero-day exploits, such as CVE-2025-48703 in Web Panel, which enabled unauthenticated remote execution and shell uploads affecting over 200,000 exposed servers. Similarly, vulnerabilities like CVE-2025-53770 (ToolShell) were actively exploited that year for unauthorized file uploads and webshell deployment, allowing remote code execution without authentication and highlighting ongoing adaptations to targets.

Technical Characteristics

Core Functionality

Web shells operate by parsing incoming HTTP requests, typically via GET or parameters, to interpret attacker-supplied commands that are often encoded in to obfuscate their content and evade basic filtering. These commands are then executed on the host operating using server-side scripting functions, such as PHP's exec() or system(), which invoke processes to perform actions like running arbitrary OS commands. Beyond basic execution, core functionality extends to supporting operations—such as uploading or downloading files—and listings, as well as interacting with databases through queries embedded in the parsed parameters. The interface provided by a web shell is typically a web-based graphical user interface (GUI) accessible via a , often secured with protection to restrict access to authorized attackers only. This GUI processes HTTP requests to display outputs from executed commands and accepts new inputs through forms, while incorporating stealth features such as mimicking legitimate patterns to blend with normal server activity. In terms of capabilities, web shells enable remote shell access by relaying command outputs back over HTTP, allowing attackers to maintain interactive control over the compromised system. They often include mechanisms for attempting , such as executing scripts that exploit local vulnerabilities to gain higher-level permissions. Logging evasion is achieved through techniques like disabling or redirecting server logs during operations, minimizing traces of the activity. Additionally, web shells can integrate with other tools to establish reverse shells, where the compromised server initiates outbound connections to the attacker's machine for bidirectional tunneling. Performance considerations in web shell design emphasize a lightweight footprint, with minimal code size to reduce the likelihood of resource-intensive detection by monitoring tools. handling is implemented to suppress exceptions and prevent crashes that might generate alerts in logs or error reports, ensuring sustained operational reliability without drawing administrative attention.

Implementation Variants

Web shells are implemented in various programming languages to target specific server environments, with being the most prevalent due to its widespread use in web applications. variants often consist of compact one-liners leveraging functions like eval() or system() to execute arbitrary commands received via HTTP requests. For Microsoft IIS servers, and variants are common, providing similar remote execution capabilities tailored to Windows-based hosting. In Java environments, JSP-based web shells enable command injection and file operations on servlet containers like . Python implementations, such as those using scripts, support cross-platform deployment on diverse servers. To evade detection, web shell developers employ obfuscation techniques such as string encoding with or , which transform readable code into encoded payloads that decode at . Code packing compresses and encrypts the script, while fetches components from external sources to avoid static analysis. In 2025, analyzed specimens featured JSON-formatted commands encrypted and Base64-encoded within HTTP POST requests, allowing modular execution of tasks like file management while bypassing signature-based scanners. Advanced implementations extend core capabilities with multi-protocol support, primarily over HTTP/S to blend with legitimate traffic. Fileless variants operate entirely in memory, leveraging rogue processes to execute commands without writing persistent files to disk, thereby complicating forensic detection. Notable encoded variants include Chopper, a minimalist web shell approximately 4 kilobytes in size, supporting multiple languages like , , and JSP for broad compatibility and features such as file upload/download and directory listing. In contrast, full-featured types like , a PHP-based shell, incorporate server information scanners to enumerate file systems, databases, and configurations, alongside tools for command execution and .

Deployment and Propagation

Delivery Mechanisms

Web shells are typically delivered to target servers through a variety of techniques that leverage initial , often obtained via prior compromises. One common method involves direct file placement using compromised credentials, where attackers utilize stolen administrator or user accounts to the server filesystem and deposit the . Automated scripts facilitate uploads over protocols such as FTP or to blend with legitimate traffic and evade network filters. Another approach is -based injection, which avoids disk writes altogether by loading the shell code directly into the server's . Once uploaded, attackers implement methods to ensure the web remains operational despite scans or reboots. Hiding the shell in legitimate directories, such as or within files, allows it to masquerade among temporary or assets, reducing the likelihood of detection during routine audits. Renaming files to mimic system components, like appending innocuous extensions or using randomly generated names, further conceals the ; for example, web shells are often uploaded with obfuscated filenames to evade allowlist-based protections. To achieve reinstallation, attackers schedule jobs that periodically download or redeploy the shell from remote locations, exploiting the cron daemon's ability to execute tasks silently and maintain access even if the primary file is removed. Evasion tactics during the upload phase are critical to bypassing server-side restrictions and . Chunked transfers break the into smaller segments, allowing attackers to circumvent size limits or content inspection filters imposed by web application firewalls. embeds the shell code within media files, such as appending scripts to images, which can then be uploaded via standard forms without triggering signature-based detection. Attackers also exploit legitimate web functions, like unsecured file upload forms in systems, to deliver shells under the guise of benign uploads, as seen in exploits targeting or similar platforms. Regarding size and packaging, web shells are often compressed or split into multiple parts to navigate upload restrictions, with payloads encoded or to avoid direct scrutiny; notes the use of such in techniques like embedded payloads to conceal malicious content within otherwise benign files. As of 2025, emerging trends include just-in-time () compilation from remote sources, where minimal bootstrap code is uploaded and dynamically fetches and assembles the full shell at , enhancing evasion against static tools.

Exploitation Vectors

Web shells are typically deployed through vulnerabilities that enable remote code execution (RCE), allowing attackers to upload and execute malicious scripts on compromised web servers. Common RCE flaws include , where unsanitized user inputs in database queries permit attackers to inject code that executes system commands, often leading to web shell placement. Local file inclusion (LFI) and remote file inclusion (RFI) vulnerabilities further facilitate this by enabling attackers to include and execute arbitrary files from local or remote sources, respectively, bypassing intended application logic. Unpatched () plugins represent a prevalent , particularly in platforms like , where vulnerabilities in extensions can expose RCE paths. For instance, flaws in plugins such as those enabling plugin uploads without proper validation have allowed attackers to inject web shells directly into the server environment. In 2025, specific high-impact vulnerabilities amplified these risks; the flaws CVE-2025-31324 and CVE-2025-42999 enabled unauthenticated file uploads, including web shells, and were actively exploited for , often in tandem for reliable persistence. Similarly, CVE-2025-48703 in Control Web Panel (CWP) permitted unauthenticated RCE via shell metacharacters in parameters, leading to widespread exploitation and web shell deployments on hosting servers. Social engineering tactics, such as phishing campaigns with malicious attachments, often grant initial server access by tricking administrators into executing payloads that escalate to web shell installation. Supply chain attacks targeting hosting providers have also surged, where compromised third-party software or credentials enable attackers to insert web shells across multiple client environments. Zero-day and N-day exploits compound these threats, with advanced persistent threat (APT) groups like Sandworm leveraging them in 2025 operations against Ukrainian targets; these campaigns deployed custom web shells, such as Localolive, alongside living-off-the-land techniques for stealthy persistence. Misconfigurations, including exposed directory listings and overly permissive file access controls, provide low-barrier entry points by allowing direct uploads or executions without authentication. According to the 2025 Threat Intelligence Index, exploitation of vulnerabilities in public-facing web applications accounted for 30% of initial access vectors across observed incidents, underscoring web environments as the dominant pathway for web shell proliferation.

Practical Examples

Basic Code Examples

Web shells often rely on languages to enable remote command execution through HTTP requests. Basic examples illustrate core mechanisms like retrieval and calls, typically with minimal input handling to prioritize over . These snippets demonstrate fundamental vulnerabilities but should never be deployed in production environments.

PHP Example

Simple PHP web shells commonly use functions like system() to execute commands passed via HTTP parameters, often with basic such as a hardcoded check to restrict access. Obfuscation techniques, including encoding of commands, are frequently employed to evade detection by firewalls or logs. For instance, attackers may pass encoded commands in GET requests and verify a password via data before execution. Such implementations provide direct shell access but lack input sanitization, exposing servers to arbitrary code execution. Direct execution without escaping or whitelisting introduces severe risks, as unsanitized inputs can execute unintended operations on the host system.

ASP Example

ASP web shells, often written in , utilize objects like WScript.[Shell](/page/Shell) to invoke operating system commands based on form inputs from HTTP requests. Basic variants may include password verification using Request.Form to gate access, followed by command execution without validation. These shells are typically deployed on IIS servers and can capture or run commands silently, facilitating and further . However, they require server configurations that permit object creation. The lack of input validation permits direct server-side execution, potentially allowing attackers to run arbitrary commands that exploit the IIS process context.

JSP Example

JSP web shells in Java environments leverage the Runtime class to execute system commands via methods like exec(), processing inputs from HTTP requests. Common implementations handle GET or POST parameters for commands, often overriding servlet methods to stream output back to the client. While basic versions may omit authentication, more advanced ones include password checks. These shells target application servers like Tomcat and can perform file operations or network actions within the JVM's permissions. Upload methods include exploiting file inclusion or WAR deployment flaws. Direct use of exec() without input escaping poses risks such as , including file access or network operations if permissions allow.

Notable Real-World Instances

One prominent example of a web shell in recent incident responses is China Chopper, a compact PHP-based tool approximately 4 kilobytes in size that relies on PHP's function for dynamic execution, allowing attackers to run arbitrary commands with minimal footprint. In September 2025, the U.S. (CISA) documented its use in a 2024 incident response to breaches in federal civilian executive branch (FCEB) agencies, where it was deployed via exploitation of CVE-2024-36401 in for initial access and persistence on servers. This deployment enabled threat actors to exfiltrate data and execute further exploits, highlighting China Chopper's role in state-sponsored intrusions targeting U.S. infrastructure. Another widely analyzed web shell is , a PHP script featuring built-in tools such as a for uploading and downloading files, an SQL dumper for extracting database contents, and password protection mechanisms to evade casual detection. In a September 2025 CybelAngel report, was examined for its persistence in compromised PHP applications, noting its inclusion of server evaluation capabilities and command execution interfaces that facilitate lateral movement. It has been commonly observed in 2025 breaches of platforms, where attackers exploited unpatched vulnerabilities in systems to install the shell and conduct data theft or preparation. In October 2025, Russian state-linked actors associated with the group targeted Ukrainian networks using a custom web shell combined with living-off-the-land (LOTL) tactics, leveraging legitimate system tools like and certutil for stealthy and . The operation involved deploying multiple web shells for , ensuring continued access even if one instance was detected, as part of broader campaigns against , , and government sectors in . This approach minimized signatures while allowing attackers to maintain footholds for months. Recent 2025 cases include an obfuscated web shell analyzed by FortiGuard Labs in July, where attackers installed a heavily encoded ASPX script named UpdateChecker.aspx on compromised (IIS) servers in Middle Eastern , using and to hide command execution and routines. Separately, identified a PHP web shell in active China-nexus campaigns starting mid-2025, deployed via in vulnerable web applications to inject one-liner scripts that enabled remote command execution and credential harvesting on targeted servers. These instances underscore the evolution of web shells toward greater and integration with legitimate tools to prolong undetected access.

Detection Methods

Static and Dynamic Analysis

Static analysis involves examining web shell without execution to identify malicious patterns, while dynamic analysis observes to detect anomalies indicative of compromise. These complementary approaches are essential for uncovering web shells, which are often obfuscated or embedded in legitimate files to evade detection. Static methods focus on characteristics, whereas dynamic techniques monitor interactions with the and . Static methods primarily rely on signature-based scanning, which searches for known malicious keywords and functions commonly used in web shells, such as eval() for dynamic code execution or system() for command invocation in PHP scripts. This approach effectively identifies straightforward implementations but requires regular updates to signature databases. Entropy analysis complements signatures by measuring the randomness of file contents; high entropy values, often exceeding 4.5 for base64-encoded payloads, signal potential obfuscation in web shells attempting to mimic benign files. Additionally, file hashing compares computed MD5 or SHA-256 values against indicators of compromise (IOCs); for instance, the China Chopper web shell variant in 0QWYSEXe.aspx has an MD5 hash of e0cca3b973e3e21ac30d77f3a33a5587, allowing rapid detection of known deployments. Dynamic methods emphasize behavioral monitoring, tracking deviations in HTTP traffic such as unusually large request sizes that may carry encoded commands to a web shell. execution provides a controlled to safely run suspicious files, observing outputs like unauthorized command executions or file modifications without risking the production system. These techniques reveal behaviors that static might miss, such as decoding of payloads. Heuristics enhance both paradigms through for encoded payloads, identifying common like or strings that conceal shell functionality. Recent advancements as of 2025 incorporate models for in , using architectures like CNN-BiLSTM to classify suspicious patterns with improved accuracy over traditional rules. Challenges in these analyses include polymorphic web shells that mutate code to evade static scans, altering signatures and profiles across instances. False positives also arise, particularly when legitimate administrative scripts employ similar keywords or generate anomalous traffic, necessitating refined heuristics to balance .

Specialized Tools and Signatures

Several open-source tools facilitate the detection of web shells through static analysis and log examination. NeoPI, developed by , is a static analyzer primarily designed for identifying hidden PHP web shells by leveraging statistical features such as information entropy, longest word length, coincidence index, feature code, and file size ratios. It excels at detecting obfuscated or encrypted content but may produce false positives on legitimate complex scripts and struggles with non-PHP shells or highly polymorphic variants. ShellSweepPlus, an open-source tool from , employs signature-based detection alongside behavioral analysis to scan web files for known malicious patterns, offering customizable rules for various scripting languages. Its strength lies in integration with existing security pipelines, though it can be limited by reliance on updated signatures against evolving threats. For log-based detection, the NSA's Mitigating Web Shells repository includes scripts tailored for analyzing IIS and access logs, identifying anomalies like unusual URI patterns, missing referrers, or repeated accesses from single hosts indicative of web shell activity. These scripts provide high specificity for server environments but require manual tuning to reduce noise from benign traffic and are less effective against encrypted communications. Commercial solutions offer advanced, integrated detection capabilities often combining signatures with . FortiWeb, a from , incorporates web shell detection policies that scan uploads for malicious scripts in languages like , , and using predefined signatures, with options to exclude known benign files. Enhanced by for , it blocks exploits in real-time but may overlook custom or zero-day shells not matching its signature database, necessitating regular updates. Defender for Cloud Apps provides scanning for web shells in uploads, integrating with Antimalware Scan Interface (AMSI) to inspect files for malicious code execution patterns during uploads or modifications. It generates alerts for potential installations, such as those exploiting vulnerabilities, and supports near-real-time analysis, though its efficacy depends on full-mode AMSI configuration and can be evaded by fileless attacks. Signatures and indicators of (IOCs) form the backbone of many detection efforts, with rules widely used to match common web shell patterns like base64-encoded execution commands. For instance, rules targeting base64 strings followed by system execution functions (e.g., exec or ) help identify reverse shells embedded in scripts. These rules are effective for known variants but falter against heavy or novel encodings, requiring community-maintained repositories for ongoing relevance. In 2025, the (CISA) updated its Known Exploited Vulnerabilities catalog to include CVE-2025-48703, a critical OS command injection in Control Web Panel (formerly Web Panel) that enables unauthenticated remote execution, often leading to web shell deployment via shell metacharacters in parameters. CISA's alerts detail associated payloads, aiding federal agencies in prioritizing patches, though exploitation in the wild highlights the need for behavioral IOCs beyond static signatures. Integration with (SIEM) systems enhances web shell detection through log correlation. apps, such as those in Enterprise Security, include plugins for parsing web traffic and access logs to correlate events like anomalous requests or URI executions with potential web shell presence, using searches for patterns in server logs. This approach enables alerting but demands robust data ingestion to avoid missing low-volume attacks. For pentesting, Online Hash Crack's 2025 detection guide outlines tricks like IOC pattern scanning for payloads and tool chaining with , emphasizing ethical removal steps to simulate attacker persistence without false positives in assessments. Limitations include dependency on tester expertise to interpret results accurately in dynamic environments.

Prevention Strategies

Server Hardening Techniques

Server hardening techniques form a foundational layer of defense against web shell deployments by addressing vulnerabilities at the level through proactive and practices. Regular patching and updating of software, applications, and operating systems are essential to mitigate known exploits that enable web shell uploads, such as remote file inclusion (RFI) or local file inclusion (LFI) attacks. For instance, in 2025, addressed critical vulnerabilities in on-premises SharePoint servers, including CVE-2025-53770, a remote execution flaw actively exploited to deploy web shells via insecure deserialization, and recommended immediate patching to prevent unauthorized uploads. Similarly, SAP NetWeaver's CVE-2025-31324 allowed unauthenticated arbitrary uploads leading to remote execution, with SAP urging customers to apply security notes released in April 2025 to block such threats. Adhering to the principle of least privilege for permissions further strengthens this approach by ensuring that processes and user accounts have minimal access rights, restricting write permissions to designated directories and preventing unauthorized modifications that could facilitate web shell persistence. Configuration controls on the server side can significantly reduce the by disabling risky features commonly abused in web shells. In PHP-based environments, enabling safe_mode (where applicable in legacy setups) and using the disable_functions directive in php.ini to block execution of dangerous functions like exec(), system(), shell_exec(), and passthru() prevents attackers from invoking commands through uploaded scripts. Web application firewalls (WAFs) provide an additional barrier by enforcing rules to detect and block RFI and LFI attempts, such as those embedding external URLs or path traversal sequences in requests; for example, WAF's default rule sets include signatures that inspect paths for IPv4-embedded RFI patterns and block anomalous traffic with scores exceeding thresholds. Implementing as a WAF module for servers allows custom rules to filter malicious payloads targeting upload endpoints, ensuring that only sanitized inputs reach the . Maintaining file integrity through targeted restrictions on upload directories is crucial to prevent web shells from executing even if uploaded. Server administrators should configure upload paths to lack execute permissions for scripts, using file system controls to enforce read-only access for non-essential directories. In Apache environments, placing an .htaccess file in upload directories with directives like <Files "*.php"> Order Deny,Allow Deny from all </Files> effectively denies PHP execution while permitting file storage, thereby neutralizing potential web shells without affecting legitimate uploads. Combining this with ModSecurity rulesets enables real-time inspection of file uploads for suspicious extensions or content, such as encoded payloads mimicking benign files. These measures collectively ensure that web servers remain resilient to exploitation vectors like insecure file handling. Enabling strict content security policies at the server level, such as through HTTP response headers that restrict script sources and inline execution, helps mitigate the execution of dynamically generated malicious content in web applications. Additionally, enforcing (MFA) for all administrative access to server management interfaces prevents credential-based compromises that could lead to shell deployments, aligning with broader zero-trust principles for protection. These targeted updates reflect the ongoing need for adaptive configurations in response to sophisticated attack innovations.

Monitoring and Response Measures

Effective of shells requires systematic surveillance of activities to identify deviations from . Organizations should implement centralized systems to analyze logs for anomalous HTTP requests, such as high-frequency command executions or unusual user agents and addresses that may indicate shell activity. () tools enable continuous for unauthorized file changes in directories, using to compare current states against known-good baselines and detect modifications like timestomping. Additionally, establishing baselines helps identify unexpected flows, such as large exfiltrations or off-peak access patterns, through tools like SIEM integrated with sensors. Upon detection of a web shell, response protocols prioritize to limit damage. Compromised servers must be isolated immediately by disconnecting from networks or segregating via firewalls to prevent lateral movement, while preserving operational where possible. Forensic imaging of affected systems, including disk and memory captures, should precede any cleanup to maintain , using bit-stream tools to create verifiable copies for analysis. For command-and-control () communications, coordinated efforts with internet service providers (ISPs) facilitate of malicious , as outlined in incident response guidelines. Automation enhances response efficiency through security orchestration, automation, and response (SOAR) platforms that deploy playbooks to automatically systems upon matching shell signatures in logs or traffic. In 2025, integrations with threat intelligence feeds, such as those from CISA, provide real-time alerts on emerging web shell indicators, enabling proactive playbook updates. To measure effectiveness, organizations conduct regular audits of monitoring configurations and response times, ensuring alignment with baselines. Incident reporting to agencies like facilitates sharing of indicators of compromise (IOCs) from ongoing campaigns, as demonstrated in 2025 advisories detailing web shell uploads via exploited vulnerabilities. This collaborative approach strengthens collective defenses against evolving threats.

References

  1. [1]
    Compromised Web Servers and Web Shells - Threat Awareness ...
    Aug 9, 2017 · A web shell is a script that can be uploaded to a web server to enable remote administration of the machine. Infected web servers can be either ...
  2. [2]
    [PDF] Detect and Prevent Web Shell Malware - DoD
    Jun 9, 2020 · Web shell malware is software deployed by a hacker, usually on a victim's web server. It can be used to execute arbitrary system commands, ...
  3. [3]
    Server Software Component: Web Shell, Sub-technique T1505.003
    Dec 13, 2019 · A Web shell is a Web script that is placed on an openly accessible Web server to allow an adversary to access the Web server as a gateway into a network.Missing: definition | Show results with:definition
  4. [4]
    Breaking Down the China Chopper Web Shell - Part I | Mandiant
    Aug 7, 2013 · China Chopper is a fairly simple backdoor in terms of components. It has two key components:the Web shell command-and-control (CnC) client binary and a text- ...
  5. [5]
    An Introduction to Web Shells (Web Shells Part 1) - Acunetix
    Apr 16, 2020 · A web shell is a malicious script used by an attacker with the intent to escalate and maintain persistent access on an already compromised web application.Persistent Remote Access · Privilege Escalation · ZombieMissing: history origins 2000s<|separator|>
  6. [6]
    What is a web shell? - Cisco Talos Blog
    May 26, 2023 · A web shell is a tool that bad actors may use to interact with and maintain access to a system, after an initial compromise.
  7. [7]
    C99Shell (Web Shell) - 'c99.php' Authentication Bypass - Exploit-DB
    Jul 10, 2014 · C99Shell (Web Shell) - 'c99.php' Authentication Bypass. CVE-108979 . webapps exploit for PHP platform.Missing: 2007 | Show results with:2007
  8. [8]
    Backdoor:PHP/C99shell.H threat description - Microsoft
    May 24, 2011 · Summary. Backdoor:PHP/C99shell.H is a detection for a script used to compromise a server running a vulnerable PHP application. Once compromised, ...Missing: web 2007
  9. [9]
    Inside the Web Shell Used in the Microsoft Exchange Server Attacks
    Apr 6, 2021 · The history and details of China Chopper - a Web shell commonly seen in the widespread Microsoft Exchange Server attacks.<|separator|>
  10. [10]
    US-CERT (CISA) Current Activity Alert - Observed China Chopper ...
    Mar 25, 2021 · First observed in 2012, China Chopper is a lightweight webshell that allows backdoor access to a vulnerable system, post compromise. The ...
  11. [11]
    Hiding Webshell Backdoor Code in Image Files - Trustwave
    Oct 11, 2013 · Web attackers have have been using a method of stashing pieces of their PHP backdoor exploit code within the meta-data headers of these image files to evade ...Missing: C99 | Show results with:C99
  12. [12]
    Obfuscated Files or Information, Technique T1027 - MITRE ATT&CK®
    A version of XTunnel introduced in July 2015 obfuscated the binary using opaque predicates and other techniques in a likely attempt to obfuscate it and ...
  13. [13]
    PHP Malware, Web Shells & Steganography Insights - Infosec Institute
    Jun 8, 2021 · Obfuscation techniques are often used to hide code and make analysis and detection harder. There are dozens of popular kinds of obfuscations, ...<|separator|>
  14. [14]
    IIS modules: The evolution of web shells and how to detect them
    Dec 12, 2022 · The concept of malicious IIS has been around since at least 2013. Historical malware analysis shows how crimeware groups used IIS modules to ...Missing: origins 2000s
  15. [15]
    IISpy: A complex server-side backdoor with anti-forensic features
    Aug 9, 2021 · The backdoor, which we named IISpy, uses a variety of tricks to interfere with the server's logging and to evade detection, in order to perform long-term ...Attack Overview · Backdoor Commands · Mitre Att&ck Techniques<|separator|>
  16. [16]
    Sandworm-linked webshell and LOTL tactics found in Russian ...
    Oct 30, 2025 · New research from the Symantec and Carbon Black Threat Hunter Team reveals that Russian-linked attackers continue to target Ukrainian ...
  17. [17]
  18. [18]
    CVE-2025-48703 Detail - NVD
    Description. CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1205 allows unauthenticated remote code execution via shell metacharacters in the ...
  19. [19]
  20. [20]
  21. [21]
    SharePoint ToolShell | Zero-Day Exploited in-the-Wild ... - SentinelOne
    Jul 21, 2025 · SentinelOne shares distinct attack clusters and a detailed timeline of events on an active exploit of the ToolShell 0-day in MS SharePoint.
  22. [22]
    Echoes in the Shell: Legacy Tooling Behind Ongoing SharePoint ...
    Aug 8, 2025 · Attackers exploit the CVE-2025-53770 vulnerability in Microsoft SharePoint to gain unauthorized remote code execution on exposed servers without ...
  23. [23]
    ToolShell Exploitation Escalates: Unpatched SharePoint Flaw ...
    Jul 21, 2025 · The flaw, tracked as CVE-2025-53770 and dubbed “ToolShell,” allows unauthenticated remote code execution and requires no user interaction.
  24. [24]
    Defending Against Web Shells - CyberStash
    A web shell is a malicious script planted on a web server, allowing attackers to execute arbitrary system commands remotely.
  25. [25]
    Keeping Web Shells Under Cover (Web Shells Part 3) - Acunetix
    Apr 14, 2020 · Commands can be sent to the web shell using various methods with HTTP POST request being the most common. However, malicious hackers are not ...
  26. [26]
    What Is a Web Shell? | Gigamon
    Sep 28, 2022 · In this article, we look at common web shell functionality, encryption, and obfuscation techniques, as well as several web shell management ...Missing: evolution anti-
  27. [27]
    Web Shells: Understanding Attackers' Tools and Techniques | F5 Labs
    Jul 6, 2023 · A web shell is a file that will be parsed and executed as code by a webserver, which sends the results of back to the originator of the web ...What Is a Web Shell? · How Do Web Shells Work? · Web Shell Capabilities
  28. [28]
    Web Shell - Invicti
    A web shell is a script that makes it possible to gain remote shell access to the web server's operating system through an HTTP connection.What Is A Web Shell? · Web Shells Vs Reverse Shells · A Typical Web Shell Attack...<|control11|><|separator|>
  29. [29]
    Defeat Web Shell WSO-NG - Akamai
    Nov 22, 2023 · To boost the stealth capabilities of WSO-NG and limit access, the web shell displays a 404 error page when users try to access its login ...
  30. [30]
    Log Disabling and Web Shell Redirection - Secureworks
    Dec 19, 2016 · SecureWorks analysis of two compromised web servers revealed that threat actors had used defensive evasion techniques in a likely attempt to avoid detection.Missing: lightweight design error
  31. [31]
    Web shell attack detection with Wazuh
    Jan 5, 2023 · Examples of supported languages include PHP, ASP, ASP.NET, Perl, Python, Ruby, Java, and Unix shell scripts. Common indicators of web shells.
  32. [32]
    Web Shells: The Hidden Backdoors Lurking in Your Server
    ### Summary of Python Web Shells Mentioned in the Content
  33. [33]
    Know your Malware - A Beginner's Guide to Encoding Techniques ...
    Oct 2, 2023 · What is Obfuscation? · Encoding Techniques · Base64 Encoding · Byte Escape Sequences · Character Encoding · Substitution Ciphers(rot13, etc.).
  34. [34]
    Malware Obfuscation Techniques: All That You Need To Know
    Mar 25, 2024 · Common malware obfuscation techniques include encoding, encryption, packing, API hashing, dead code, and fooling the disassembler.
  35. [35]
    In-Depth Analysis of an Obfuscated Web Shell Script | FortiGuard Labs
    Jul 25, 2025 · In this blog, we will explore the obfuscation techniques used to protect the web shell, the structure of its control commands, formatted in ...
  36. [36]
    What is a Web Shell? C99 Explained - CybelAngel
    Sep 22, 2025 · How do attackers upload a webshell? What are the signs of a webshell on a server? How can you prevent webshell attacks? Why are webshells so ...Missing: 2007 | Show results with:2007
  37. [37]
    SQL Injection in Multiple WordPress Plugins - Research Advisory
    Joshua Martinelle of Tenable Research discovered multiple SQL Injection vulnerabilities across a number of WordPress plugins. This advisory will track each ...Missing: shell RCE LFI RFI unpatched CMS
  38. [38]
    Remote File Inclusion (RFI) - Invicti
    Remote file inclusion (RFI) is a web vulnerability that lets a malicious hacker force the application to include arbitrary code files imported from another ...Missing: unpatched CMS
  39. [39]
    LFI and RFI Attacks - All You Need to Know - Astra Security Blog
    Oct 16, 2024 · Local File Execution (LFI) and Remote File Execution (RFI) are similar to the nefarious Cross-Site Scripting (XSS) attacks. All of them are forms of code ...Missing: shell RCE unpatched
  40. [40]
    WordPress RCE Vulnerability: CVE-2024-31210 Alert - Qualys Blog
    May 6, 2025 · A critical RCE flaw in WordPress allows plugin upload exploitation. Learn how to detect and mitigate this vulnerability before attackers ...Missing: vectors LFI RFI unpatched CMS
  41. [41]
    Active Exploitation of CVE-2025-31324 and CVE-2025-42999 in the ...
    Sep 12, 2025 · It enables remote attackers to upload malicious files—such as web shells—without authentication. CVE-2025-42999 is an insecure deserialization ...Missing: SharePoint | Show results with:SharePoint
  42. [42]
    IBM X-Force 2025 Threat Intelligence Index
    Apr 16, 2025 · By clicking on links that seem legitimate, users can unknowingly open the door to infostealer malware that siphons sensitive data from victims.Top Initial Access Vectors · Phishing As A Shadow... · Success Of Vulnerability...
  43. [43]
    The Weak Link: Recent Supply Chain Attacks Examined - Cyberint
    In this blog we will focus on third-party cyber attacks and the recent spike in “third-party breached and update tampering attacks”.
  44. [44]
    Web Shells 101 Using PHP (Web Shells Part 2) | Acunetix
    Apr 14, 2020 · In part 2 of this series, we'll be looking at some specific examples of web shells developed using the PHP programming language.
  45. [45]
    P.A.S. Fork v. 1.0 — A Web Shell Revival - Sucuri Blog
    Oct 26, 2020 · A PHP web shell containing multiple functions can easily consist of ... A hashed password can also be hardcoded and used instead.P.A.S. V. X Web Shell -- The... · Code Analysis · Obfuscated/hashed Requests...
  46. [46]
    Hacking with JSP Shells - NetSPI
    In this blog, I'll provide two JSP shell code examples and outline five common upload methods that can be used to get the shells onto vulnerable servers.
  47. [47]
    Breach Roundup: Chinese Chopper Hackers Attack US Agency
    Sep 25, 2025 · This week, China Chopper, a U.S. DHS high value system and a global cybercrime crackdown. Stellantis disclosed a breach.
  48. [48]
    CISA Shares Lessons Learned from an Incident Response ...
    Sep 23, 2025 · CISA began incident response efforts at an FCEB agency after the agency identified potential malicious activity through security alerts ...
  49. [49]
    Sandworm-linked attackers continue to target Ukrainian organizations
    Oct 30, 2025 · The attackers used a custom Sandworm-linked webshell and relied extensively on living-off-the-land techniques and dual-use tools, ...<|separator|>
  50. [50]
    Russian Hackers Target Ukrainian Organizations Using Stealthy ...
    Oct 29, 2025 · Organizations in Ukraine have been targeted by threat actors of Russian origin with an aim to siphon sensitive data and maintain persistent ...Missing: zero- day APT
  51. [51]
    Chinese Hackers Weaponize Open-Source Nezha Tool in New ...
    Oct 8, 2025 · "They then issued a query containing their one-liner PHP web shell, causing it to be recorded in the log file," Huntress explained.
  52. [52]
    The Crown Prince, Nezha: A New Tool Favored by China-Nexus ...
    Oct 8, 2025 · Beginning in mid-2025, Huntress discovered a new tool being used to facilitate webserver intrusions known as Nezha, which up until now ...
  53. [53]
    A New Webshell Detection Method Based on Abstract Syntax Tree ...
    Jun 26, 2025 · A Webshell is essentially an executable web script written by exploiting the characteristics of web programming languages. Typically, web ...<|control11|><|separator|>
  54. [54]
    Ghost in the Web Shell: Introducing ShellSweep - Splunk
    Jan 5, 2024 · ShellSweep uses a heuristic-based approach, measuring the entropy (or randomness) of file contents to identify potential web shells. While high ...Missing: matching | Show results with:matching
  55. [55]
    MAR-10331466-1.v1: China Chopper Webshell | CISA
    ... 1.v1: China Chopper Webshell. Last Revised. April 12, 2021. Alert Code. AR21-102A. body#cma-body { font-family: Franklin Gothic Medium, Franklin Gothic, ...
  56. [56]
    Research and application of artificial intelligence based webshell ...
    Apr 28, 2024 · Webshell also has a variety of forms, including common file formats (i.e. ASP, ASPX, PHP, JSP, PL, PY, etc.) and even high-resolution images. In ...
  57. [57]
    Web Shell Detection: Script Process Child of Common Web Processes
    Use a private sandboxed malware analysis system to perform analysis. Observe and collect information about the following activities: Attempts to contact ...
  58. [58]
    splunk/ShellSweep - GitHub
    Multi-layered Detection: ShellSweepX employs various detection methods including entropy analysis, pattern matching, and heuristic analysis, providing a ...
  59. [59]
    Network–Level Polymorphic Shellcode Detection Using Emulation
    Aug 7, 2025 · We present a heuristic detection method that scans network traffic streams for the presence of polymorphic shellcode. Our approach relies on a ...
  60. [60]
    False Positives in Web Application Security – Facing the Challenge
    This white paper examines the impact of false positives across the software development lifecycle, suggests ways of eliminating false alarms in ...
  61. [61]
    CiscoCXSecurity/NeoPI - GitHub
    The intended purpose of NeoPI is to aid in the detection of hidden web shell code. The development focus of NeoPI was creating a tool that could be used in ...Missing: static | Show results with:static
  62. [62]
    An enhanced covert and scalable backdoor injection attack on web ...
    As an example, NeoPI (Anon, 0000a) is a very popular web shell detection tool based on statistical analysis, and it can detect obfuscated or encrypted contents ...
  63. [63]
    Introducing ShellSweepPlus: Open-Source Web Shell Detection
    Jul 10, 2024 · ShellSweepPlus is an open-source tool designed to empower security teams in detecting potential web shells. It is an enhanced version of ShellSweep.
  64. [64]
    Guidance for mitigation web shells. #nsacyber - GitHub
    The provided Snort signatures can be used to detect some common web shells that have not been modified to evade detection. Some intrusion detection/preventions ...
  65. [65]
    Web Shell Detection | FortiWeb 8.0.2 - Fortinet Document Library
    Web Shell Detection. Attackers may attempt to upload Trojan horse code (written in scripting languages such as PHP and ASP) to the back-end web servers.
  66. [66]
    waf webshell-detection-policy | FortiWeb 8.0.2
    Enable or disable FortiWeb to detect Python script type according to known signatures. enable. edit <webshell-name>. Enter the web shell name to exclude it. The ...
  67. [67]
    Disrupting active exploitation of on-premises SharePoint ... - Microsoft
    Jul 22, 2025 · This blog shares details of observed exploitation of CVE-2025-49706 and CVE-2025-49704 and the follow-on tactics, techniques, and procedures ( ...
  68. [68]
    Built-in virus protection in SharePoint, SharePoint Embedded ...
    Sep 3, 2025 · Microsoft 365 uses a common virus detection engine for scanning files that users upload to SharePoint, SharePoint Embedded, OneDrive, and Microsoft Teams.Missing: shell | Show results with:shell
  69. [69]
    Web Shells. An Introduction and Detection Strategies with YARA ...
    Oct 5, 2020 · From the YARA lab, a rules directory should exist and a file called weevely.yara can be created and saved. cd / mkdir rules cd rules nano ...
  70. [70]
    Known Exploited Vulnerabilities Catalog | CISA
    CVE-2025-48703. CWP Control Web Panel OS Command Injection Vulnerability: CWP Control Web Panel (formerly CentOS Web Panel) contains ...
  71. [71]
  72. [72]
    Web shell present in web traffic events - Splunk Lantern
    Jul 7, 2025 · If these URLs found in the web server logs are called successfully, you can assume that the web server is infected with the webshell.
  73. [73]
    Web Shell Detection Tricks 2025: Find & Remove - Online Hash Crack
    Detect and eradicate malicious web shells before attackers pivot. IOC patterns, scanning tools and hardening steps every 2025 pentester needs.
  74. [74]
    Customer guidance for SharePoint vulnerability CVE-2025-53770
    Jul 19, 2025 · The following alert titles in the Microsoft Defender Security Center portal can indicate threat activity on your network: Possible web shell ...Summary · Microsoft Defender... · Microsoft Defender For...
  75. [75]
    Threat Brief: CVE-2025-31324 (Updated June 25)
    May 23, 2025 · This vulnerability allows unauthenticated users to upload arbitrary files to an SAP NetWeaver application server, leading to potential remote code execution ( ...Executive Summary · Details of CVE-2025-31324 · Current Scope of Attacks...
  76. [76]
    What Is the Principle of Least Privilege? - Palo Alto Networks
    The principle of least privilege is all about providing the minimum amount of privilege possible for users to get their work done. Unfortunately, legacy ...
  77. [77]
    PHP.INI settings Disable exec, shell_exec, system, popen and Other ...
    Oct 16, 2022 · Learn how to disable dangerous php functions used by hackers/crackers to hack your LINUX / UNIX server by editing php.ini file settings.
  78. [78]
    PHP Security Best Practices, Vulnerabilities and Attacks - Vaadata
    Oct 30, 2024 · The first step in limiting the risk of command injection is to disable potentially dangerous PHP functions. This can be done via the ...
  79. [79]
    CRS and DRS rule groups and rules - Azure Web Application Firewall
    Sep 17, 2025 · If the anomaly score is 5 or greater, and the WAF is in Prevention mode, the request is blocked. If the anomaly score is 5 or greater, and the ...
  80. [80]
    Deny access to files using .htaccess - catalyst2
    Dec 17, 2021 · This article looks at Apache's Files and FilesMatch directives. Both are used to allow or deny access to files on your website.
  81. [81]
    How To Disable PHP Execution and Directory Browsing? - Patchstack
    Dec 5, 2023 · In this article, you can learn how to disable PHP execution and directory browsing in WordPress to enhance your WordPress site security.Missing: mod_security | Show results with:mod_security<|separator|>
  82. [82]
    Enhance security with the principle of least privilege - Microsoft Learn
    Oct 23, 2023 · The information security principle of least privilege asserts that users and applications should be granted access only to the data and operations they require ...
  83. [83]
    [PDF] Guide to Integrating Forensic Techniques into Incident Response
    ITL develops tests, test methods, reference data, proof of concept implementations, and technical analysis to advance the development and productive use of.
  84. [84]
    [PDF] Cybersecurity Incident & Vulnerability Response Playbooks - CISA
    The Vulnerability Response Playbook applies to vulnerabilities being actively exploited in the wild. As required by EO 14028, the Director of OMB will issue ...
  85. [85]
    CISA Red Team's Operations Against a Federal Civilian Executive ...
    Jul 11, 2024 · Work with security information and event management (SIEM) and security orchestration, automation, and response (SOAR) providers—in conjunction ...