What is a web shell?¶
A web shell is code placed on a web server to allow commands or actions to be carried out remotely through web requests.
Avoid the dangerous assumption¶
The dangerous assumption is that every unusual web file is a web shell, or that the presence of one proves it was used.
It does not.
A web shell may allow an offender to:
- run commands
- upload or download files
- browse directories
- alter website content
- create accounts
- move further into the environment
- maintain access.
It may be a very small script hidden among legitimate website files or embedded within an altered application component.
Investigators should preserve:
- the suspected file
- its full path
- hash values
- timestamps
- web-server logs
- application logs
- process activity
- commands executed
- files created
- network connections
- authentication and deployment records.
Ask how the file arrived. It may have been uploaded through a vulnerability, stolen credentials, an administrative interface, file-transfer service or compromised developer account.
A web request to the file may support evidence of use, but not every request proves successful command execution.
Likewise, the absence of obvious requests does not exclude use if logs are missing or the shell used another route.
Do not delete the file before preserving its content and surrounding evidence.
A web shell may persist after the original vulnerability is patched.
The shell may use ordinary web requests that resemble legitimate application traffic. Correlate requests with process creation and file-system change rather than relying on unusual URLs alone.
Operational takeaway¶
Treat a suspected web shell as a remote access mechanism, preserve the file and server records and prove use separately from presence.