SECURITY REVIEW
Not yet assessed
Review the original instructions and requested permissions before installing.
No security review is available for this catalog entry yet.
Community / AGENT SKILL
analyzing-webshells
0
Analyzes suspected webshells (PHP, ASPX/ASP, JSP) by detecting dynamic-execution sinks, input-to-sink data flow, and common encoder/obfuscation chains, then decoding obvious layers to reveal the command interface. Activates for requests to analyze a webshell, identify a PHP/ASPX/JSP backdoor, or deobfuscate server-side malicious scripts.
Understand the trade-offs.
SKILL QUALITY
Not yet assessed
How clearly the skill guides your agent, how complete its workflow is, and how you can check the outcome.
No quality assessment is available for this catalog entry yet.
The full skill.
Original instructions from the publisher’s SKILL.md
# Analyzing Webshells ## When to Use - You found a suspicious server-side script (`.php`, `.aspx`, `.jsp`, `.asp`) and need to confirm it is a webshell and understand its command interface. - You are triaging a web-server compromise and want to classify dropped scripts. **Do not use** a live web server to execute the script to "test" it — that runs attacker code. Analyze the source statically. ## Prerequisites - The suspect script file(s), read inertly. ## Safety & Handling - Read the file statically; never deploy or request it on a live server. Defang any URLs. ## Workflow ### Step 1: Detect execution sinks and input flow ```bash python scripts/analyst.py scan shell.php ``` Flags dynamic-execution sinks (`eval`, `assert`, `system`, `exec`, `passthru`, `Runtime.exec`, ASPX `eval()`/`Process.Start`) and whether request input (`$_GET`/`$_POST`/`Request`) reaches them. ### Step 2: Identify obfuscation/encoder chains Detects `base64_decode`, `gzinflate`, `str_rot13`, `eval(chr(...))`, hex `\x` strings, and `FromBase64String` chains commonly wrapping the payload. ### Step 3: Decode obvious layers Apply base64/rot13/gzinflate where present to reveal the inner command interface (best-effort, non-executing). ### Step 4: Classify and report Note the language, the password/parameter gate (if any), and capabilities (file manager, command exec, SQL, upload); defang IOCs. ## Validation - A flagged file pairs an execution sink with attacker-controlled input. - Encoder chains are identified and, where safe, decoded statically. - Capability classification is backed by concrete code evidence. ## Pitfalls - Legitimate admin tools that also use `eval`/`system` — corroborate with input flow. - Multi-stage shells that fetch the real logic remotely. - Deeply nested or runtime-built obfuscation that static decode only partly unwinds. ## References - See [`references/api-reference.md`](references/api-reference.md) for the scanner. - ATT&CK T1505.003 (linked in frontmatter).