---
name: webshell-analysis
description: >
  Detect and analyze web server backdoors (webshells) in PHP, ASPX, JSP, and
  Python. Use when investigating compromised web servers, detecting unauthorized
  server-side scripts, analyzing obfuscated webshell code, or assessing webshell
  capabilities and C2 mechanisms.
---

# Webshell Analysis

Systematic detection and analysis of web server backdoor scripts.

## When to Use

- Web server compromise suspected
- Unusual files discovered in web directories
- Web application firewall alerting on suspicious requests
- Post-incident web server forensics
- Hunting for persistent access after web application exploit

## Prerequisites

- **Python 3.10+** with standard library modules
- **scripts/webshell_detector.py**: Automated webshell scanning and detection
- **scripts/webshell_deobfuscator.py**: Webshell code deobfuscation
- **NeoPI**: Statistical analysis-based webshell detection
- **PHP Malware Finder**: PHP-specific malware detection
- **YARA**: Signature-based detection rule creation
- **Access to web server logs** (Apache/Nginx) for timeline correlation
- **Access to web server document root** for filesystem scanning

## Step-by-Step Instructions

### Step 1: Detection Scan

```bash
# Scan web directories for potential webshells
python3 scripts/webshell_detector.py --path /var/www/html --output scan_results.json

# Focus on specific file types
python3 scripts/webshell_detector.py --path /var/www --extensions php,aspx,jsp
```

Detection heuristics:
- Suspicious function calls (eval, exec, system, passthru, shell_exec)
- Obfuscation patterns (base64_decode chains, gzinflate, str_rot13)
- High entropy content (encrypted/encoded payloads)
- File timestamp anomalies (modification time doesn't match deployment)
- File size anomalies (much smaller/larger than similar files)

### Step 2: Classify Webshell Type

**By Capability Level:**
| Level | Description | Examples |
|-------|-------------|---------|
| Simple | Single command execution function | `<?php system($_GET['c']);?>` |
| Standard | File manager + command execution | WSO, b374k |
| Advanced | Full-featured with auth, DB access, network tools | China Chopper, Weevely |
| Memory-only | No persistent file, runs in memory | Fileless webshells via deserialization |

**By Language:**
- **PHP**: Most common — eval(), system(), passthru(), shell_exec()
- **ASPX/ASP**: Process.Start(), cmd.exe invocation
- **JSP**: Runtime.exec(), ProcessBuilder
- **Python**: os.system(), subprocess, exec()

### Step 3: Deobfuscation

```bash
# Deobfuscate webshell code
python3 scripts/webshell_deobfuscator.py --file webshell.php --output decoded.txt
```

Common obfuscation techniques:
- **PHP**: `eval(base64_decode(gzinflate(str_rot13(...))))` chains
- **Variable functions**: `$f = "system"; $f($cmd);`
- **String construction**: `$a="sy"; $b="stem"; ($a.$b)($cmd);`
- **Encoding**: Base64, hex, URL encoding, custom alphabets
- **Encryption**: AES/XOR encrypted payload with key in request

### Step 4: Capability Analysis

Document webshell features:
- Command execution method
- File management (upload, download, edit, delete)
- Database access (connection strings, query execution)
- Network tools (port scanning, reverse shell)
- Authentication mechanism (password, cookie, header)
- Persistence method (file modification, scheduled tasks)
- Anti-detection features (access logging suppression)

### Step 5: C2 Analysis

Analyze how attacker communicates with webshell:
- HTTP parameter names used for commands
- Request/response encoding scheme
- Authentication tokens or passwords
- Custom HTTP headers
- POST body structure

### Step 6: Access Timeline

Correlate webshell with web server logs:
```bash
# Search access logs for webshell requests
grep -n "webshell_filename" /var/log/apache2/access.log
grep -n "webshell_filename" /var/log/nginx/access.log

# Look for POST requests to the webshell
# Identify source IPs, timestamps, frequency
```

### Step 7: IOCs and Detection

- File hash (SHA256)
- File name and path
- Authentication credentials/tokens
- HTTP indicators (User-Agent, parameters)
- YARA rules (use `yara-rule-development` skill)
- Web server log patterns
- Map to MITRE ATT&CK:
  - T1505.003: Server Software Component: Web Shell
  - T1059: Command and Scripting Interpreter

## Tools

| Tool | Purpose |
|------|---------|
| scripts/webshell_detector.py | Automated webshell scanning |
| scripts/webshell_deobfuscator.py | Code deobfuscation |
| NeoPI | Statistical webshell detection |
| PHP Malware Finder | PHP-specific detection |
| YARA | Signature-based detection |

## Related Skills

- `malware-deobfuscation` — Advanced deobfuscation techniques
- `ioc-extraction` — Extract URLs, IPs from webshell code
- `yara-rule-development` — Create detection rules