thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Operations · Intermediate

Web Shell

A malicious script uploaded to a web server that gives an attacker remote command execution through HTTP.

Definition

Web shells written in PHP, ASP.NET or JSP accept commands via web requests and run them with the web server's privileges. They are planted after exploiting upload flaws or vulnerabilities in internet-facing apps such as Exchange or file transfer servers. Detection includes file integrity monitoring and looking for web server processes spawning shells.

Example

A China Chopper ASPX file planted on an Exchange server after ProxyLogon exploitation.

Exam tip

w3wp.exe or httpd spawning cmd.exe or bash is a strong web shell indicator.

Related terms