From 84e78e898a77f8ea2e9ca775b3feab94a6995499 Mon Sep 17 00:00:00 2001 From: vulf Date: Thu, 1 Oct 2020 19:34:44 +0530 Subject: [PATCH] Added a list of popular web shells --- Web-Shells/backdoor_list.txt | 893 +++++++++++++++++++++++++++++++++++ 1 file changed, 893 insertions(+) create mode 100644 Web-Shells/backdoor_list.txt diff --git a/Web-Shells/backdoor_list.txt b/Web-Shells/backdoor_list.txt new file mode 100644 index 00000000..adec74c7 --- /dev/null +++ b/Web-Shells/backdoor_list.txt @@ -0,0 +1,893 @@ +host.php +simple-backdoor.php +proxy.php +shell.php +php-reverse-shell.php +tiny.php +up.php +php-backdoor.php +cmd.php +killnc.php +dns.php +file.php +list.php +cmd.cfm +cfSQL.cfm +cfExec.cfm +shell.cfm +ListServlet.java +UpServlet.java +CmdServlet.java +ListServlet.java +cmd.jsp +ListServlet.class +cmdjsp.jsp +cmd_win32.jsp +up_win32.jsp +CmdServlet.class +cmd.war +cmd.jsp +web.xml +MANIFEST.MF +makewar.sh +UpServlet.class +jsp-reverse.jsp +browser.jsp +simple.jsp +UpServlet.java +up.jsp +list.jsp +CmdServlet.java +cmd.c +laudanum.php +host.php +proxy.php +shell.php +php-reverse-shell.php +settings.php +killnc.php +dns.php +file.php +ipcheck.php +README.md +nc.exe +cmd.aspx +shell.asp +cmdasp.aspx +dns.asp +cmdasp.asp +cmd.asmx +up.asp +cmd.asp +cmd-asp-5.1.asp +list.asp +proxy.asp +ntdaddy.asp +file.asp +list.txt +shell.aspx +up.sh +list.sh +cmd.sh +up.pl +perlcmd.cgi +list.pl +cmd.pl +README.md +simple-shell.jsp +file.aspx +dns.aspx +shell.aspx +proxy.php +shell.php +php-reverse-shell.php +dns.php +file.php +CREDITS +shell.cfm +cmd.war +cmd.jsp +web.xml +MANIFEST.MF +makewar.sh +shell.asp +dns.asp +proxy.asp +file.asp +GPL +README +plugin-shell.php +bypass-login.php +obfuscated-phpshell.php +cmd.aspx +nc.exe +up.sh +cmd.jsp +up.php +cmd.php +list.sh +cmd.sh +list.php +reverse.jsp +list.jsp +cmd-simple.php +shell.cfm.html +audit_null.c +audit_null.patch +README.md +liveterm.py +console.py +struct.py +logger.py +__init__.py +udpio.py +livehack.py +socket_live8.py +customize.js +openfire-test_plugin.zip +readme.txt +LICENSE.html +reGeorgSocksProxy.py +LICENSE.txt +tunnel.jsp +tunnel.tomcat.5.jsp +tunnel.js +tunnel.php +tunnel.ashx +README.md +tunnel.aspx +servlet-api-3.04.jar +readme.txt +MSSQL控制程序.asp +mysql脱库.php +mssql.aspx +oracle.txt +mysql.aspx +zip.func.php +db_mysql_error.inc.php +db_mysql.class.php +pnbak.js +index.php +config.inc.php +pnbak.css +index.htm +oracle.jsp +脱库工具.php +xx.php +phpwebbackup.php +mssql.asp +paxmac.jspx +cmd.jspx +oo.jpg +base64.md +jspspy.jspx +jsp.jpg +jspx.jspx +cmd.jpg +base64.jspx +ListServlet.java +UpServlet.java +CmdServlet.java +cmd.c +findsock.c +devilzShell.cgi +Gamma Web Shell.cgi +msf_webacoo_module.rb +LICENSE +webacoo.pl +TODO +CHANGELOG +README +MSF_README +Silic Group.jsp +pwnshell - an interactive jsp shell.jsp +JspSpy Codz By - Ninty.jsp +新型JSP小马支持上传任意格式文件.jsp +小马.jsp +login.jsp +spjspshell.jsp +shell.jsp +JSP Backdoor Reverse Shell.jsp +jshell ver 1.0.jsp +内网探测.jsp +JFoler 1.0.jsp +BackerHack JSP Manage-System 1.0.jsp +苦咖啡专用.jsp +Command Execution (win32).jsp +hahahaha小马.JSp +cmdjsp.jsp +jspy.jsp +JspSpy Private Codz By - Ninty_encode.jsp +JspTqz.jsp +内网扫描header.jsp +JspSpy Codz By - Ninty_1.jsp +JSP Shell 岁月联盟专用版本.jsp +Jsp反弹shell.txt +Mysql Database.jsp +jspspy_k8.jsp +XXOO.jsp +GetShell.html +上传小马.jsp +SJavaWebManageV1.4.jsp +devilzShell.jsp +jshell ver 0.1.jsp +使用方法.txt +demo.gif +023.jsp +1427683968524.jpg +by Bagheera.jsp +灭天远程管理.jsp +cat.jsp +使用说明.txt +cat.jar +cat.jspx +JspSpy Private Codz By - Ninty.jsp +JspDo Code By Xiao.3.jsp +老V.jsp +Jspspy web~shell V1.0 ※MADE by 孤水绕城 QQ540410588.jsp +JspSpy.jsp +logger小马.jsp +caidao.jsp +JspHelper Codz By - Leo.jsp +Oracle Database.jsp +LICENSE +Customize.soap +xssshell-xsstunnell.zip +木马帮V1.1-火舌版.asp +upfile_write.asp +土司搞基asp大马.asp +旁注 - 网站小助手.asp +UnKnown 高级Vip防删收费版.asp +JspWebShell By 绝对零度.asp +devshell.asp +红狼ASP木马--Anfly免杀版.asp +在线数据库管理工具 1.5.asp +密码:889.asp +NTDaddy v1.9.asp +3fexe Shell.asp +传说中的草泥马4.0.asp +啊D小工具 - 目录读写检测 [ASP版].asp +RedHat Hacker.asp +Welcome To AK Team.asp +radhat.asp +法克僵尸大马.asp +Expdoor.com ASP专用小马.asp +很好用的扫可读可写目录asp脚本xwdir.asp +devilzShell.asp +TNTHK加密小马.asp +download 下载文件.asp +list.cer +目录扫描.asp +mima_abcd.jpg +img.jpg +JFIF.asp +gif89a.asp +gif87a.jpg +I.N.F HACKING CENTER.asp +银河舰队大马_2015专版asp大马.asp +r00ts无FSO组建大马.asp +DJ团队.asp +小红帽.asp +星外-华众-新网-虚拟主机提权专用Webshell Mumaasp.com发布.asp +File upload.asp +牛逼免杀提权隐藏大马.asp +inDEXER And ReaDer.asp +不灭之魂2013改进版本.asp +404 infiltrate team.asp +Elmali Seker.asp +KOA ASP类 WebShell扫描工具.asp +asp wget drag database.asp +Web Shell.asp +h4ck_Door.asp +by EJDER.asp +Server Variables.asp +xynu-Normal University.asp +修改属性.asp +上传小马.asp +不灭之魂.asp +虚拟主机提权专用Webshell去后门版.asp +up.asp +银河舰队大马_2014版.asp +ZehirIV.asp +CyberSpy5.Asp +火狐NEW WebShell.asp +Aventis KlasVayv 1.0.asp +目录扫描读写马.asp +PcAnywhere提权 Bin版本.asp +80sec内部专用过世界杀软休积最小功能超强超猛宇宙第一.asp +传说中的hcker.asp +08小组内部交流专用.asp +RedHat Hacker.asp明文版.asp +ELMALISEKER Backd00r.asp +RHTOOLS 1.5 BETA(PVT) Edited By KingDefacer.asp +hkmjj.asp +RHTOOLS 1.5 BETA(PVT).asp +Stored Procedure Execute.aspx +forever5pi.asp +CmdAsp.asp +Remote Explorer.asp +ASPYDrvsInfo.asp +upfile_write.rar +bypass-iisuser-p.asp +星外-华众-新网-虚拟主机提权专用Webshell.asp +虚拟机主机提权大马.asp +草莓webshell.asp +STHx 渗透小组专用 ASP小马.asp +海阳顶端网ASP木马@2006PLUS - By Marcos.asp +r00ts小组过防火墙马.asp +aspxshell.aspx +ASP Cmd Shell On IIS 5.1.asp +小强asp木马.asp +AspRootkit 1.0 by BloodSword.asp +mssql.asp +炽天使.asp +aspSH.v1.asp +devshell.cfm +cmd.cfm +cfSQL.cfm +cmfshell.cmf +xl.cfm +cfmShell.cfm +list.cfm +ColdFusion.chm +cfexec.cfm +mycode12.cfm +devshell.md +ice.cfm +functions.c +pwnginx +functions.h +Makefile +pwnginx.c +config +ngx_http_pwnginx.c +socks5.h +config.h +pwnginx.h +pwnginx.c +README.md +pwnginx-master.zip +xml.asp +xml.aspx +xml.php +4.png +xslt.php +3.png +2.png +xslt.asp +1.png +xslt.aspx +WebShell系列(一)---XML.txt +Axis2Shell-master.zip +shell.ascx +up.sh +list.sh +cmd.sh +icmpsh-s.c +run.sh +icmpsh-m.pl +icmpsh-m.c +icmpsh_m.py +README.md +icmpsh.exe +running_icmpsh_master_on_attacker_machine.png +running_icmpsh_slave_on_target.png +response_packet_from_icmpsh_slave_containing_output_of_command_whoami.png +gdog.py +requirements.txt +LICENSE +shellcode_generate.py +client.py +.gitignore +.gitignore +README.md +GO.cgi.pl +inc.pl +lurm_safemod_on.cgi.pl +Silic Group_readme.txt +perl-reverse-shell.pl +ka0tic.pl +exim.pl +Cgitelnet.pl +remot shell.pl +Silic Group_cgi.pl +WebShell.cgi.pl +dc.pl +up.pl +perlcmd.cgi +list.pl +rcpexp.pl +Perl Web Shell by RST-GHC.pl +hmass (priv8 mass defacor).pl +telnet.pl +telnet.cgi.pl +pps-v3.5.pl +pps-v1.0.pl +pps-v3.0.pl +pps-v4.0.pl +cmd.pl +ping.c +README.md +LICENSE.md +webshell.rb +revsshclient.py +revsshserver.py +Readme.txt +print.png +test_rsa.key +client.py +server.py +README.md +sidedoor.docs +control +rules +sidedoor.postinst +copyright +sidedoor.upstart +compat +sidedoor.install +sidedoor.service +format +sidedoor.postrm +changelog +sidedoor.dirs +sidedoor.links +sidedoor.default +config +COPYING +ssh_client_config_example +sudoers +sidedoor +README.md +JSRat.ps1 +README.md +usage.txt +Customize.asmx +合成图片马命令.txt +Asp_Aspx_Php_V1.jpg +ASP_Client.html +caidao-20160622.zip +零魂PHP一句话木马客户端.htm +jpg_payload.php +Asp_Aspx_Php一句话合集.txt +Asp_Aspx_Php_V2.jpg +caidao-20141213.zip +xshock-0.1.tar.gz +cgi-python.py +llehs.py +webllehs.py +d00r_py3.py +darkBC.py.txt +Phyton Shell.py +Server.py +Client.py +setup.py +README.md +about.txt +smtpd.py +pyspy.py +sctp_reverse.py.txt +wh_bindshell.py +Command Shell.php +KA_uShell 0.1.6.php +Safe_Mode Bypass PHP 4.4.2 and PHP 5.1.2.php +get.php +megabor.php +sosyete.php +Sosyete Safe Mode Bypass Shell - Edited By KingDefacer.php +12309.php +tryag.php +simple-backdoor.php +lamashell.php +DAws.php +php-findsock-shell.php +DDoS attack.php +spygrup.php +php MySQL Database Backup Script.php +Adminer - Compact database management.php +ntunnel_mysql.php +GRP WebShell 2.0 release build 2018 (C)2006,Great.php +Ayyildiz Tim -AYT- Shell v 2.1 Biz.txt +Shell [ci] .Biz was here.php +中国木马资源网- WwW.7jyewu.Cn.php +listfile.php +Private x0rg Web Hosting Bypass.php +Spider PHP Shell (SPS-3.0).php +Moroccan Spamers Ma-EditioN By GhOsT.php +Edited By KingDefacer.php +bdshell.php +Rootshell.v.1.0.php +r57_kartal.php +GFS_web-shell_ver_3.1.7_-_PRiV8.php +PHP Web Shell by oTTo.php +kolang-bypass.php +Gamma Web Shell.php +PhpShell 2.0.php +FaTaL Shell v1.0 - Edited By KingDefacer.php +lama's'hell v. 3.0.php +h4ntu_shell_[powered_by_tsoi].php +Simple_PHP_backdoor_by_DK.php +load_shell.php +WinX Shell.php +dC3 Security Crew Shell PRiV.php +B374k Beta ShElL V1.php +ru24_post_sh.php +cpanel.php +PHPRemoteView.php +matamu.php +AventGrup-Sincap 1.0.php +Ajax_PHP Command Shell.php +hiddens shell v1.php +在线exp专用免杀版.php +nsT View.php +lolipop.php +KAdot Universal Shell v0.1.6.php +AK-74 Security Team.php +ZyklonShell.php +NetworkFileManagerPHP.php +c0derz shell [csh] v. 0.1.1 release.php +Dive Shell 1.0 - Emperor Hacking Team.php +Changing CHMOD Permissions Exploit.php +b374k-mini-shell-php.php.php +Liz0ziM Private Safe Mode Command Execuriton Bypass Exploit.php +nshell.php +mod_joomla_shell.zip +pHpINJ.php +r57shell127.php +angel.php +ZoRBaCK Connect.php +Deface Keeper 0.2.php +Antichat Shell v1.3.php +Moroccan_Spamers_Ma-EditioN_By_GhOsT.php +qsd-php-backdoor.php +php-reverse-shell.php +reverseshell-poc.php +toby57解析加密一句话木马.php +JFIF.jpg +bypass_RCE_php.gif +phppng.png +图片马.jpg +gif89a.jpg +404.php +xx.png +Ani-Shell.php +Antichat Shell.php +BLaSTER.php +pws.php +azrail 1.0 by C-W-M.php +404webshell.php +soldierofallah.php +PHVayv.php +404super.php +readme.md +make2.php +dev_core.php +code.php +pas.php +SimShell_1.0_-_Simorgh_Security_MGZ.php +ftpsearch.php +C99madShell v. 2.0 madnet edition.php +pHp一句话扫描脚本程序.php +Php Backdoor v 1.0 by ^Jerem.php +Backup script on server.php +I-47 v1.3.php +WordPress Shell.php +DTool Pro.php +CrystalShell v.1.php +boffmax_v1.0_web_shell_by_the-c0de_team(1).php +cw.php +ex0shell.php +phpinfo.php +kral.php +h4ntu shell [powered by tsoi].php +Uploading.php +ava Server Faces MiniWebCmdShell 0.2 by HeartLESS.php +Serv-U本地权限提升工具.php +PhpSpy Ver 2006.php +Safe_Mode_Bypass_PHP_4.4.2_and_PHP_5.1.2.php +Loader'z WEB Shell v 0.1.0.2.php +WebShell.php +udf.dll 专用网马.php +Mysql interface v1.0.php +CasuS 1.5.php +r57_iFX.php +Mysql_interface_v1.0.php +wordpress backdoor.php +change.php +navicat_tunnel.php +xnonymoux_webshell_ver_1.0.php +www.zjjv.com.php +lostDC shell.php +wp-conten1_pass_KoR345Ker78DSa.php +NCC Shell v1.0.0.php +Silic Group php Webshell v3.php +up.php +fatal.php +KAdot_Universal_Shell_v0.1.6.php +A robust backdoor script made by Daniel Berliner.php +Safe mode breaker.php +PH Vayv.php +php-backdoor.php +PHP整站打包程序-By DoDo.php +sys32.php +ASPYDrvsInfo.php +SnIpEr_SA Shell.php +LICENSE +client.php +README.md +server.php +lostDC.php +s72 Shell v1.0 Codinf by Cr@zy_King.php +exp.php +simattacker.php +PHP检测文件夹权限.php +SPS-3.0免杀.php +NGH.php +极其隐蔽的pHp小马穿插在正常页面中.php +Uploader.php +sniffer.php +myshell.php +bitwise.php +Small Web Shell by ZaCo.php +scanner.php +NCC-Shell.php +c999shell.php +Backdoor php v0.1 Coded By Charlichaplin.php +Dive_Shell_1.0_Emperor_Hacking_Team.php +NTDaddy v1.9.php +Macker's Private PHPShell.php +上传马.php +phpshell17.php +moon_1php.php +SST Sheller.php +erne.php +dC3_Security_Crew_Shell_PRiV.php +Webcommander by Cr4sh_aka_RKL v0.3.9 NGH edition.php +Worse Linux Shell.php.php +from_the_wild1.php +仗剑孤行搜索可读可写目录脚本.php +Knull Shell.php +Sincap 1.0.php +accept_language.php +PH_Vayv.php +php版iisspy.php +rootshell.php +r57.biz Dq99Shell.php +Non-alphanumeric.php +small.php +529.php +Coppermine Photo Gallery = 1.4.3 remote cmmnds xctn.php +PHP小马 - ExpDoor.com.php +wp-conf.php +Worse Linux Shell.php +Aria cPanel cracker version 1.0 - Edited By KingDefacer.php +Matamu Mat.php +PHANTASMA.php +MySQL Web Interface Version 0.8.php +PHPJackal v1.9.php +Bnkqbakq.php +c99_locus7s.php +Safe0ver Shell -Safe Mod Bypass By Evilc0der.php +mysql_tool.php +cls_Base.php +Confusion to encrypt php webshell.php +nShell v1.0.php +c99_madnet.php +Web-shell (c)ShAnKaR.php +safe0ver.php +SimAttacker - Vrsion 1.0.0 - priv8 4 My friend.php +404.php +AK-74 Security Team Web Shell Beta Version.php +simple_cmd.php +SimAttacker - Version 1.0.0 - Edited By KingDefacer.php +Password Hasher for PHP Shell 2.1.php +license.zip +Carbylamine PHP Encoder.php +s72_Shell_v1.1_Coding.php +r57shell v.1.42 - Edited By KingDefacer.php +r57shell.php +cybershell.php +bdotw44shell.php +Security House - Shell Center - Edited By KingDefacer.php +devilzShell.php +mmm.php +SimShell 1.0 - Simorgh Security MGZ.php +s72 Shell v1.1 Coding.php +Predator.php +PostgreSQL数据库操纵.php +gfs_sh.php +Lolipop.php - Edited By KingDefacer.php +config.m4 +backdoor.c +hideme.cpp +zend_config.w32.h +stdafx.h +README.md +W3D Shell.php +GFS web-shell ver 3.1.7 - PRiV8.php +EgY_SpIdEr ShElL V2.php +aZRaiLPhp_v1.0.php +c99_webshell.php +菊花聊天室.php +backupsql.php +backdoorfr.php +Back Connect.php +mof提权带回显带清楚命令版本.php +php读取iis.php +Mysql udf by M4ster.php +PHP 搜索可读可写目录脚本.php +PHP Shell.php +Micro_Webshell.php +LOTFREE PHP Backdoor v1.5.php +client2.php +client1.php +server1.php +server2.php +r57_Mohajer22.php +Win MOF Shell.php +t57shell.php +iMHaPFtp.php +robot.php +zaco.php +Shell Commander.php +STNC WebShell v0.8.php +中国木马资源网-WwW.MumaSec.TK.php +Cyber Shell.php +Antichat Socks5 Server v 1.0.php +Ayyildiz Tim -AYT- Shell v 2.1 Biz.php +Dx.php +Silic Group Hacker Army - BlackBap.Org.php +Loaderz WEB Shell.php +php-include-w-shell.php +README.md +g00nshell-v1.3.php +zacosmall.php +bypass safemodel.php +phpwebbackup.php +b374k.php.php +Small Shell - Edited By KingDefacer.php +Antichat_Shell_v1.3.php +sure.php +404 Not Found.php +aZRaiLPhp v1.0.php +MySQL Web Shell.php +PHP-Shell-Detector-master.zip +ironshell.php +stres.php +WSO2.7 404 Error Web Shell.php +Antichat Shell. Modified by Go0o$E.php +Hypn.ashx +include.ashx +xx.ashx +shell.jpg +write_asp_file.ashx +write_aspx_file.ashx +reGeorg-master.zip +axis2 利用小工具cat.pdf +axis2 利用小工具cat.aar.zip +Readme.md +ACat-src.zip +ACat-附数据库驱动.jar +readme.md +ACat-附数据库驱动-jdk1.5.jar +ACat.jar +ACat_jdk1.5.jar +includer.txt +litteryi.txt +includer.php +litteryixx.ASP +readme.MD +test.ear +test.war +config.aar +Utils.java +README.md +SQL.aspx +ASP.NET Web BackDoor.aspx +hec.aspx +从注册表中读存在路径.aspx +ASPX one line Code Client by amxku.aspx +ASPX小马 - 黑兵社团.aspx +上传马.aspx +凝聚科技专用AspX大马 Bysunue.aspx +MYSQL Manager -Asp.net Silic Group Hacker Army专用版本.aspx +Command.aspx +fileupload.aspx +冰锋刺客.aspx +cmdsql.aspx +Antak Webshell.aspx +xxooxx.aspx +wso.aspx +z8VSmO1418105414843.jpg +Code by Bin.aspx +ASPX +AspxSpy2014Final.aspx +devilzShell.aspx +ASPXspy.aspx +国外牛逼大马.aspx +view.aspx +Stored Procedure Execute.aspx +WebAdmin 2.X Final.aspx +专版aspx汗血宝马.aspx +Web Sniffer.aspx +awen asp.net webshell.aspx +filesystembrowser.aspx +ASPXspy by NightRunner.aspx +ASPX Shell.aspx +WebSniff 1.0 Powered by C.C.T.aspx +README.md +config +HEAD +exclude +HEAD +master +HEAD +master +HEAD +pre-rebase.sample +pre-commit.sample +fsmonitor-watchman.sample +update.sample +commit-msg.sample +post-update.sample +pre-push.sample +applypatch-msg.sample +pre-applypatch.sample +pre-merge-commit.sample +pre-receive.sample +prepare-commit-msg.sample +description +packed-refs +pack-6a5fbf3093c3c63aa794c842cf9da81dc956d2cd.pack +pack-6a5fbf3093c3c63aa794c842cf9da81dc956d2cd.idx +index +test3693.war +one1.jsp +one.jsp +web.xml +MANIFEST.MF +css1.jsp +css.jsp +one.war +punkholic.php +by.php +wso2.8.5.php +alfav3.0.1.php +obfuscated-punknopass.php +cmd.php +punk-nopass.php +mini.php +smevk.php +c99ud.php +andela.php +alfa3.php +configkillerionkros.php +r57.php +jspshell.jsp +README.md +config +HEAD +exclude +HEAD +master +HEAD +master +HEAD +pre-rebase.sample +pre-commit.sample +fsmonitor-watchman.sample +update.sample +commit-msg.sample +post-update.sample +pre-push.sample +applypatch-msg.sample +pre-applypatch.sample +pre-merge-commit.sample +pre-receive.sample +prepare-commit-msg.sample +description +packed-refs +pack-a9e6fede5fa9947e97aa566caa3357ec1c1844b4.idx +pack-a9e6fede5fa9947e97aa566caa3357ec1c1844b4.pack +index +bloodsecv4.php