| name | hunting-web-backdoors |
| description | Hunt for planted webshells and server-side backdoors on web infrastructure — recently-changed files in web roots, dangerous-callable content signatures (eval/system/base64), YARA scans, web-server log anomalies (POST to static-looking paths, rare user agents), and web-server processes spawning shells. Use when a web server is suspect or a post-exploitation foothold is likely, not when testing for the vulnerability that would allow one. A webshell hides in plain sight as a valid file; find it by change, content, and behavior. |
| verified | 2026-08-08T00:00:00.000Z |
Hunting Web Backdoors
A webshell is a legitimate-looking file in a place that serves code, dropped
after an attacker got write access, that turns an HTTP request into command
execution. It is among the most durable footholds on internet-facing systems and
among the easiest to overlook, because it is a valid .php/.aspx/.jsp file
sitting in a directory full of valid files. You cannot find it by asking "is this
malware" one file at a time; you find it by three orthogonal lenses — what
changed, what the content can do, and how the file behaves when requested —
and by trusting the overlap.
Confirm the host is in scope per AGENTS.md. Preserve before you
poke: on a live suspect server, capture the web root and logs (and memory, if
warranted) before touching files, so timestamps and the shell itself are not
contaminated by your own activity.
When to Use
- A web server is suspected of harboring a planted shell or backdoor
- Sweeping web roots after a confirmed or suspected exploitation
- Confirming or refuting a hunt lead or alert pointing at web infrastructure
