A web shell is a shell-like interface that enables a web server to be remotely accessed, often for the purposes of cyberattacks.[1] A web shell is unique in that a web browser is used to interact with it.[2][3]
A web shell could be programmed in any programming language that is supported on a server. Web shells are most commonly written in PHP due to the widespread usage of PHP for web applications. Though Active Server Pages, ASP.NET, Python, Perl, Ruby, and Unix shell scripts are also used.[1][2][3]
Using network monitoring tools, an attacker can find vulnerabilities that can potentially allow delivery of a web shell. These vulnerabilities are often present in applications that are run on a web server.[2]
An attacker can use a web shell to issue shell commands, perform privilege escalation on the web server, and the ability to upload, delete, download, and execute files to and from the web server.[2]
- ^ a b "How can web shells be used to exploit security tools and servers?". SearchSecurity. Archived from the original on 2019-03-28. Retrieved 2018-12-21.
- ^ a b c d US Department of Homeland Security (9 August 2017). "Web Shells – Threat Awareness and Guidance". www.us-cert.gov. Archived from the original on 13 January 2019. Retrieved 20 December 2018.
This article incorporates text from this source, which is in the public domain.
- ^ a b admin (3 August 2017). "What is a Web shell?". malware.expert. Archived from the original on 13 January 2019. Retrieved 20 December 2018.
