analyzing-webshells

Name: analyzing-webshells
Author: meltedinhex

18stars5forks

How to install analyzing-webshells?

meltedinhex/analyst-ai-pack/analyzing-webshells

$npx -y skills add meltedinhex/analyst-ai-pack --skill analyzing-webshells

Installs into the current project.

Summary

Analyzes suspected webshells (PHP, ASPX/ASP, JSP) by detecting dynamic-execution

Files · 1

View on GitHub

SKILL.md

1	# Analyzing Webshells
2
3	## When to Use
4
5	- You found a suspicious server-side script (`.php`, `.aspx`, `.jsp`, `.asp`) and need to confirm
6	it is a webshell and understand its command interface.
7	- You are triaging a web-server compromise and want to classify dropped scripts.
8
9	Do not use a live web server to execute the script to "test" it — that runs attacker code.
10	Analyze the source statically.
11
12	## Prerequisites
13
14	- The suspect script file(s), read inertly.
15
16	## Safety & Handling
17
18	- Read the file statically; never deploy or request it on a live server. Defang any URLs.
19
20	## Workflow
21
22	### Step 1: Detect execution sinks and input flow
23
24	```bash
25	python scripts/analyst.py scan shell.php
26	```
27
28	Flags dynamic-execution sinks (`eval`, `assert`, `system`, `exec`, `passthru`, `Runtime.exec`,
29	ASPX `eval()`/`Process.Start`) and whether request input (`$_GET`/`$_POST`/`Request`) reaches them.
30
31	### Step 2: Identify obfuscation/encoder chains
32
33	Detects `base64_decode`, `gzinflate`, `str_rot13`, `eval(chr(...))`, hex `\x` strings, and
34	`FromBase64String` chains commonly wrapping the payload.
35
36	### Step 3: Decode obvious layers
37
38	Apply base64/rot13/gzinflate where present to reveal the inner command interface (best-effort,
39	non-executing).
40
41	### Step 4: Classify and report
42
43	Note the language, the password/parameter gate (if any), and capabilities (file manager, command
44	exec, SQL, upload); defang IOCs.
45
46	## Validation
47
48	- A flagged file pairs an execution sink with attacker-controlled input.
49	- Encoder chains are identified and, where safe, decoded statically.
50	- Capability classification is backed by concrete code evidence.
51
52	## Pitfalls
53
54	- Legitimate admin tools that also use `eval`/`system` — corroborate with input flow.
55	- Multi-stage shells that fetch the real logic remotely.
56	- Deeply nested or runtime-built obfuscation that static decode only partly unwinds.
57
58	## References
59
60	- See [`references/api-reference.md`](references/api-reference.md) for the scanner.
61	- ATT&CK T1505.003 (linked in frontmatter).

People who liked this also viewed

6 picks

Type

find-skillsHelps users discover and install agent skills when they ask questions like "how do I do X", "find a skill for X", "is there a skill that can...", or express interest in extending capabilities. This skSkillsJul 20262.6M27k
grill-meA relentless interview to sharpen a plan or design.SkillsJul 2026633k182k
vercel-react-best-practicesVercel's official collection of agent skillsSkillsJul 2026573k29k
improve-codebase-architectureScan a codebase for deepening opportunities, present them as a visual HTML report, then grill through whichever one you pick.SkillsJul 2026522k182k
setup-matt-pocock-skillsConfigure this repo for the engineering skills — set up its issue tracker, triage label vocabulary, and domain doc layout. Run once before first use of the other engineering skills.SkillsJul 2026454k182k
triageMove issues and external PRs through a state machine of triage roles — categorise, verify, grill if needed, and write agent-ready briefs.SkillsJul 2026424k182k

analyzing-webshells

18stars5forks

View on GitHub

How to install analyzing-webshells?

meltedinhex/analyst-ai-pack/analyzing-webshells

$npx -y skills add meltedinhex/analyst-ai-pack --skill analyzing-webshells

Installs into the current project.

Summary

Analyzes suspected webshells (PHP, ASPX/ASP, JSP) by detecting dynamic-execution

Files · 1

View on GitHub

SKILL.md

1	# Analyzing Webshells
2
3	## When to Use
4
5	- You found a suspicious server-side script (`.php`, `.aspx`, `.jsp`, `.asp`) and need to confirm
6	it is a webshell and understand its command interface.
7	- You are triaging a web-server compromise and want to classify dropped scripts.
8
9	Do not use a live web server to execute the script to "test" it — that runs attacker code.
10	Analyze the source statically.
11
12	## Prerequisites
13
14	- The suspect script file(s), read inertly.
15
16	## Safety & Handling
17
18	- Read the file statically; never deploy or request it on a live server. Defang any URLs.
19
20	## Workflow
21
22	### Step 1: Detect execution sinks and input flow
23
24	```bash
25	python scripts/analyst.py scan shell.php
26	```
27
28	Flags dynamic-execution sinks (`eval`, `assert`, `system`, `exec`, `passthru`, `Runtime.exec`,
29	ASPX `eval()`/`Process.Start`) and whether request input (`$_GET`/`$_POST`/`Request`) reaches them.
30
31	### Step 2: Identify obfuscation/encoder chains
32
33	Detects `base64_decode`, `gzinflate`, `str_rot13`, `eval(chr(...))`, hex `\x` strings, and
34	`FromBase64String` chains commonly wrapping the payload.
35
36	### Step 3: Decode obvious layers
37
38	Apply base64/rot13/gzinflate where present to reveal the inner command interface (best-effort,
39	non-executing).
40
41	### Step 4: Classify and report
42
43	Note the language, the password/parameter gate (if any), and capabilities (file manager, command
44	exec, SQL, upload); defang IOCs.
45
46	## Validation
47
48	- A flagged file pairs an execution sink with attacker-controlled input.
49	- Encoder chains are identified and, where safe, decoded statically.
50	- Capability classification is backed by concrete code evidence.
51
52	## Pitfalls
53
54	- Legitimate admin tools that also use `eval`/`system` — corroborate with input flow.
55	- Multi-stage shells that fetch the real logic remotely.
56	- Deeply nested or runtime-built obfuscation that static decode only partly unwinds.
57
58	## References
59
60	- See [`references/api-reference.md`](references/api-reference.md) for the scanner.
61	- ATT&CK T1505.003 (linked in frontmatter).

People who liked this also viewed

6 picks

Type