webshell
A collection of web shell scripts (PHP, JSP, ASP and others) gathered for security testing.
- Stars
- 10.8k
- Forks
- 5.5k
- Licence
- MIT
- Language
- PHP
- Last update
- 1.9 years ago
- Type
- Other
No commits in over a year — check for forks or alternatives before adopting.
What it is
This repository is a collection of webshell scripts written in languages such as PHP, ASP, ASPX, JSP, Perl and Python. A webshell is a small script placed on a web server that lets someone run commands or manage files through a browser. The README describes the collection as intended for testing, and lists many other webshell projects and website management tools.
- Browse sample webshell scripts in different server languages for study
- Compare the webshell projects linked in the README
- Use the listed projects as references when researching webshell detection
Great for
- Security researchers studying how webshells work
- Penetration testers who need sample scripts in a test environment
- Defenders building or tuning detection rules for webshells
Not ideal for
- Anyone wanting to access servers they do not own or have permission to test, since the README warns against illegal activity
- Beginners looking for a polished application, because this is a loose set of scripts rather than a product
- Users who need a verified-safe download, because the author states they do not guarantee the shells are free of backdoors
How to get it
- 1
Clone and build from source
Clone the repository
git clone https://github.com/tennc/webshell - 2
Run it
- Clone the repository and open it in a text editor.
- Review the scripts and the README before deploying anything.
- Only run the files in a test environment you own or are authorized to test.
- 3
Get the most out of it
- Read the linked README_EN.md for the English guide
- Compare entries with the other webshell projects listed in the README
- Use the management tool links in the README to understand how such tools operate
Downloads
Strengths
- Covers many server languages in one place, including PHP, JSP, ASP, ASPX, Perl and Python
- Points to a large list of related projects and tools in the README
- Released under the MIT license
Trade-offs
- The README states the author does not guarantee the shells are free of backdoors, so files need careful review before use
- The README is mostly in Chinese and the description gives little detail on usage
- The README gives no install or run instructions
How it compares
| Project | Stars | Type | Level | Updated | Best for |
|---|---|---|---|---|---|
| webshell (this) | 10.8k | Other | advanced | 1.9 years ago | Security researchers studying how webshells work |
| anti-AD | 10.9k | Other | beginner | 5 days ago | People who want network-wide ad and tracker blocking on a home router or DNS server |
Stats synced from GitHub. The assessment above was drafted with AI from the project's README on 2026-10-29 and may miss recent changes — check the README before relying on a command. MIT licence: free to use, modify and distribute, including commercially, as long as you keep the copyright notice.