Web Shell

A web shell is a file that an attacker secretly places on a foreign web server. The server is a computer that provides web pages or other services to users. To the server, the file looks like a perfectly normal web page — but in reality it contains a hidden control program. Anyone who knows the address of this file can use it to send commands to the server, just as if they were sitting directly in front of it. All of this happens through the normal channel that every browser uses, which is why it often goes unnoticed for a long time.

Web shells as a persistent access point for attackers

The decisive advantage of a web shell from an attacker’s perspective is its persistence. A security vulnerability that enabled the initial break-in can be closed afterward — the web shell still remains on the server. The attacker thus has a permanent back entrance, which experts refer to as a “backdoor”.

This makes web shells particularly dangerous for companies and government agencies. An attacker can remain undetected for months, steal data, or use the server for further attacks on other systems. When investigating compromised servers, security researchers regularly find web shells that had been lying dormant there for a year or longer.

Structure and concealment of a web shell

At its core, a web shell consists of just a few lines of program code written in a language that the web server can execute anyway — for example PHP or Python. This code accepts a command, executes it on the server, and sends the result back. In the simplest case, this really amounts to just three to five lines.

To avoid detection, attackers obfuscate this code. They give the file a harmless name, such as “image_resize.php”, or hide the actual code behind an unreadable string of characters that the server only decodes at execution time. Some web shells look in the browser like a complete control panel with a file manager, text input, and status display — with the entire interface running on the compromised server.

It is important to note the difference from a virus: a web shell does not spread on its own. It is actively placed after an attacker has already found an initial vulnerability — for example, an outdated plugin of a content management system, i.e., software that website operators use to manage their content. The web shell is therefore not a break-in tool, but rather the lock that gets screwed onto the door after it has already been broken open.

Web shells in security incidents and the news

Web shells keep turning up in major security incidents. In 2021, state-sponsored attackers from China exploited a vulnerability in Microsoft Exchange — a widely used email software for businesses. In doing so, they planted tens of thousands of web shells on servers worldwide before Microsoft was able to close the gap. Government agencies in Europe and the United States were among those affected at the time.

Ransomware groups — criminals who encrypt data and demand ransom — also use web shells as an intermediate step. They gain access, explore the network over weeks, and only launch the actual attack once they know enough about the target. In this sequence, web shells are often the invisible first step that gets reconstructed afterward.

For defense, security teams use specialized programs to search their servers for conspicuous files — for example, code that decrypts hidden strings of characters, or files that have been recently modified without anyone on the team having uploaded anything. Intelligence and security agencies such as Germany’s BSI, the Federal Office for Information Security, also regularly publish warnings and detection rules specifically for web shells.