reverse-skills-max/vendor-new/analyst-ai-pack/skills/analyzing-webshells/SKILL.md

name, description, domain, subdomain, tags, version, author, license, mitre_attack, d3fend, references

name	description	domain	subdomain	tags	version	author	license	mitre_attack	d3fend	references
analyzing-webshells	Analyzes suspected webshells (PHP, ASPX/ASP, JSP) by detecting dynamic-execution sinks, input-to-sink data flow, and common encoder/obfuscation chains, then decoding obvious layers to reveal the command interface. Activates for requests to analyze a webshell, identify a PHP/ASPX/JSP backdoor, or deobfuscate server-side malicious scripts.	cybersecurity	malware-analysis	malware-analysis webshell php aspx server-side	1.0.0	analyst-ai-pack	Apache-2.0	T1505.003 T1059 T1027	D3-FCR D3-DA	MITRE ATT&CK T1505.003 Web Shell — https://attack.mitre.org/techniques/T1505/003/ OWASP web shell detection guidance — https://owasp.org/

Analyzing Webshells

When to Use

• You found a suspicious server-side script (.php, .aspx, .jsp, .asp) and need to confirm it is a webshell and understand its command interface.
• You are triaging a web-server compromise and want to classify dropped scripts.

Do not use a live web server to execute the script to "test" it — that runs attacker code. Analyze the source statically.

Prerequisites

• The suspect script file(s), read inertly.

Safety & Handling

• Read the file statically; never deploy or request it on a live server. Defang any URLs.

Workflow

Step 1: Detect execution sinks and input flow

python scripts/analyst.py scan shell.php

Flags dynamic-execution sinks (eval, assert, system, exec, passthru, Runtime.exec, ASPX eval()/Process.Start) and whether request input ($_GET/$_POST/Request) reaches them.

Step 2: Identify obfuscation/encoder chains

Detects base64_decode, gzinflate, str_rot13, eval(chr(...)), hex \x strings, and FromBase64String chains commonly wrapping the payload.

Step 3: Decode obvious layers

Apply base64/rot13/gzinflate where present to reveal the inner command interface (best-effort, non-executing).

Step 4: Classify and report

Note the language, the password/parameter gate (if any), and capabilities (file manager, command exec, SQL, upload); defang IOCs.

Validation

• A flagged file pairs an execution sink with attacker-controlled input.
• Encoder chains are identified and, where safe, decoded statically.
• Capability classification is backed by concrete code evidence.

Pitfalls

• Legitimate admin tools that also use eval/system — corroborate with input flow.
• Multi-stage shells that fetch the real logic remotely.
• Deeply nested or runtime-built obfuscation that static decode only partly unwinds.

References

• See references/api-reference.md for the scanner.
• ATT&CK T1505.003 (linked in frontmatter).