reverse-skills-max: initial public release (restored, redacted, hardened)

vendor-new/analyst-ai-pack/skills/analyzing-webshells/SKILL.md

@@ -0,0 +1,90 @@
+---
+name: analyzing-webshells
+description: 'Analyzes suspected webshells (PHP, ASPX/ASP, JSP) by detecting dynamic-execution
+  sinks, input-to-sink data flow, and common encoder/obfuscation chains, then decoding obvious
+  layers to reveal the command interface. Activates for requests to analyze a webshell, identify a
+  PHP/ASPX/JSP backdoor, or deobfuscate server-side malicious scripts.'
+domain: cybersecurity
+subdomain: malware-analysis
+tags:
+  - malware-analysis
+  - webshell
+  - php
+  - aspx
+  - server-side
+version: 1.0.0
+author: analyst-ai-pack
+license: Apache-2.0
+mitre_attack:
+  - T1505.003
+  - T1059
+  - T1027
+d3fend:
+  - D3-FCR
+  - D3-DA
+references:
+  - 'MITRE ATT&CK T1505.003 Web Shell — https://attack.mitre.org/techniques/T1505/003/'
+  - 'OWASP web shell detection guidance — https://owasp.org/'
+---
+
+# Analyzing Webshells
+
+## When to Use
+
+- You found a suspicious server-side script (`.php`, `.aspx`, `.jsp`, `.asp`) and need to confirm
+  it is a webshell and understand its command interface.
+- You are triaging a web-server compromise and want to classify dropped scripts.
+
+**Do not use** a live web server to execute the script to "test" it — that runs attacker code.
+Analyze the source statically.
+
+## Prerequisites
+
+- The suspect script file(s), read inertly.
+
+## Safety & Handling
+
+- Read the file statically; never deploy or request it on a live server. Defang any URLs.
+
+## Workflow
+
+### Step 1: Detect execution sinks and input flow
+
+```bash
+python scripts/analyst.py scan shell.php
+```
+
+Flags dynamic-execution sinks (`eval`, `assert`, `system`, `exec`, `passthru`, `Runtime.exec`,
+ASPX `eval()`/`Process.Start`) and whether request input (`$_GET`/`$_POST`/`Request`) reaches them.
+
+### Step 2: Identify obfuscation/encoder chains
+
+Detects `base64_decode`, `gzinflate`, `str_rot13`, `eval(chr(...))`, hex `\x` strings, and
+`FromBase64String` chains commonly wrapping the payload.
+
+### Step 3: Decode obvious layers
+
+Apply base64/rot13/gzinflate where present to reveal the inner command interface (best-effort,
+non-executing).
+
+### Step 4: Classify and report
+
+Note the language, the password/parameter gate (if any), and capabilities (file manager, command
+exec, SQL, upload); defang IOCs.
+
+## Validation
+
+- A flagged file pairs an execution sink with attacker-controlled input.
+- Encoder chains are identified and, where safe, decoded statically.
+- Capability classification is backed by concrete code evidence.
+
+## Pitfalls
+
+- Legitimate admin tools that also use `eval`/`system` — corroborate with input flow.
+- Multi-stage shells that fetch the real logic remotely.
+- Deeply nested or runtime-built obfuscation that static decode only partly unwinds.
+
+## References
+
+- See [`references/api-reference.md`](references/api-reference.md) for the scanner.
+- ATT&CK T1505.003 (linked in frontmatter).