What is web-shell deployment?¶
The practical answer¶
Web-shell deployment is the placement of server-side code that allows remote commands or file operations through web requests.
The key evidential caution¶
The dangerous assumption is that finding a web shell proves how the attacker first entered the system.
It does not.
The shell may have been placed through:
Key points¶
- a vulnerable upload function
- stolen administrator credentials
- command injection
- compromised deployment tools
- remote access
- a software vulnerability
- a supply-chain route
Evidence to preserve¶
Investigators should preserve:
Key points¶
- the web-shell file
- path and hash
- creation and modification time
- creator account or process
- upload or deployment records
- web requests to the shell
- commands and parameters
- process activity
- files created
- network connections
The presence of the shell proves a potential access mechanism.
It does not automatically prove it was used.
Request and process records may show whether commands were issued.
A shell may also be copied automatically across replicated servers or containers.
Evidential limits¶
Do not assume multiple copies mean repeated offender action.
The original entry route, shell creation and later use should be treated as separate questions.
Web-shell use may be intermittent and may continue after the initial vulnerability is patched. Compare request times with command execution, file changes and account activity. If the application is rebuilt from a compromised image or backup, the shell may return without a new intrusion.
Where several servers contain matching shells, compare deployment, replication and file timestamps. Common infrastructure may have copied one shell automatically, while different content or creation routes may support separate compromise events.
Operational takeaway¶
Preserve the shell, creation route and use records, and do not treat its presence as automatic proof of initial access or successful command execution.