Web shell facts for kids
A Web shell is a special computer program, or script, that someone can upload to a web server. Think of it like a secret remote control! Once it's on the server, it lets someone manage that computer from far away.
Web shells can be written in many computer languages, like PHP or ASP, which are very common on web servers. Other languages like Perl, Ruby, Python, and Unix shell scripts can also be used.
After a web shell is successfully uploaded, a hacker can use it to gain more control over the server. They can then run commands, which means they can tell the server to do things. These commands depend on what the web server is allowed to do. For example, they might be able to add, delete, or run files, or even run other programs and scripts on the server.
Types of Web Shells
There are many different kinds of web shells. Some common ones that hackers often use include China Chopper, WSO, C99, and B374K. Here are a few examples:
- b374k – This web shell is written in a language called PHP. It can do things like watch what programs are running on the server and run commands. The newest version is 3.2.3.
- C99 – This is a version of the WSO shell but with extra features. It can show information about the server's security and even has a way to delete itself.
- China Chopper – This is a very small web shell, but it has many powerful features. It can help hackers control the server and even try to guess passwords.
- WSO – This stands for "web shell by orb." It's clever because it can pretend to be an error page on a website, but it has a hidden login area.
- Some web shells can be incredibly short, even just one line of code! For example:
<?=`$_GET[1]`?> This tiny web shell is only 15 bytes in size.
How Web Shells Get On Servers
Web shells usually get onto web servers because of weaknesses in web applications or mistakes in how the server is set up. Here are some ways they can be uploaded:
- Cross-site scripting (XSS) – This is when a hacker injects harmful code into a website that is then run by other users' browsers.
- SQL injection – This happens when a hacker uses special code in a website's input fields to trick the database into doing things it shouldn't.
- Weaknesses in applications – Many websites use popular software like WordPress. If this software has a security flaw, a web shell might be uploaded through it.
- Problems with file uploads – Sometimes, websites allow users to upload files, but they don't check these files carefully enough. This can let a web shell slip through.
- Remote file inclusion (RFI) and local file inclusion (LFI) – These are vulnerabilities where a website can be tricked into running code from another file, either from the internet or from the server itself.
- Unprotected admin pages – If the pages used to manage a website are not properly secured, a hacker might be able to access them and upload a web shell.
Images for kids
-
A b374k shell running on a Windows 7 Ultimate Edition server.
