Web Shell
Definition
A script (typically PHP, ASP, or JSP) placed on a web server by an attacker to provide remote command execution via HTTP requests. Web shells are a common persistence mechanism on internet-facing servers and can survive a service restart if they are not explicitly located and removed.
- Common languages
- PHP, ASP, JSP
- Function
- Remote command execution via HTTP requests
- Typical target
- Internet-facing web servers
- Persistence risk
- Survives a service restart if not removed
Common questions
Why is a web shell hard to detect through normal monitoring?+
It rides on ordinary HTTP traffic to the web server, so it does not trigger the alerts a separate malicious process or unusual outbound connection would. Detection typically relies on file-integrity checks, web-log anomaly analysis, or scanning for known shell signatures.
What does eradicating a web shell require beyond deleting the file?+
Investigators must confirm how the shell was planted (an unpatched application vulnerability, weak credentials, or a vulnerable plugin) and close that entry point, since removing the file alone leaves the server open to reinfection.
Related terms
- Configuration Drift
- Deviation from an approved baseline configuration, whether caused by legitimate administrative action or by an attacker modifying settings to weaken defences or...
- Indicator of Compromise (IoC)
- An observable artefact that suggests a system has been involved in a malicious event. Static analysis produces file-based IoCs: cryptographic hashes, embedded...
- Persistence Mechanism
- The technique malware uses to survive a reboot or user logout. Common methods include registry run keys, scheduled tasks, Windows services, cron...
- Reimaging
- Wiping a compromised system and restoring it from a known-good operating system image. Reimaging is the most reliable eradication method for host-level...
- Rogue Account
- A user or service account created by the attacker during the intrusion to maintain access independent of any compromised legitimate account. Rogue...