Glossary
Webshell
A malicious script (often in PHP, JSP, or ASPX) dropped onto a compromised web server to give an attacker persistent remote access and arbitrary command execution. The webshell acts as a backdoor after initial exploitation and frequently survives reboots. Detecting it relies on spotting unusual files in web directories and suspicious execution patterns.
A webshell signals an already-underway compromise
A webshell is never a starting point: it is dropped after a flaw (insecure upload, RCE, authentication bypass) has granted initial access. It turns that one-off access into a lasting presence, letting the attacker return, run commands, and stage exfiltration. Modern ransomware campaigns drop webshells with random (hexadecimal) names to hinder detection.
How to spot and prevent them
On prevention: validate and rename uploaded files, store them outside the served web root, and forbid script execution in content directories. On detection: watch for new .php/.jsp/.aspx files appearing in web paths, unusual child processes spawned by the web server, and requests to URLs that match no legitimate application route.
Frequently asked questions
How does a webshell get onto a server?
Through a flaw exploited upstream: an insecure upload feature accepting an executable file, a remote code execution (RCE), or an authentication bypass granting access to an admin interface. The webshell is then written to a directory served by the web server.
Will an antivirus detect webshells?
Not always. Webshells can be obfuscated, encoded, or minimal to evade signatures. Reliable detection combines file-integrity monitoring, server behavioral analysis, and web access review rather than antivirus alone.