Log in Request a demo

Glossary

Web Shell.

Also called webshell, web backdoor script

In Short

A web shell is a script placed on a web server that gives an attacker a way to run commands on that server from a remote location. MITRE ATT&CK says adversaries use web shells to keep persistent backdoor access to a system.

Last updated October 23, 2026
Profile MapGlossary Term
  1. Also Called2other nameswebshell · web backdoor script
  2. Related Terms3linked entriesPersistence · Remote code execution (RCE) · Lateral movement

What Is a Web Shell?

MITRE ATT&CK describes a web shell as a web script placed on an accessible web server. MITRE says it lets an adversary use the web server as a gateway into a network, and it can provide command execution or remote shell functions. MITRE lists it as technique T1505.003, Web Shell.

How Does a Web Shell Work?

MITRE says a web shell may have a client interface program that talks to the web server. It names the China Chopper web shell client as an example. The script on the server is the server part, and the attacker’s tool talks to it. Attackers first get a web shell onto a server by exploiting a flaw in a web application or runtime, such as the PHP2Shell flaws in PHP. Another example is the Joomla JCE remote code execution flaw CVE-2026-48907, which CISA says allows upload and execution of PHP code.

MITRE also says adversaries use web shells to keep a persistent backdoor. A backdoor is a hidden way back into a system. Persistence means staying in a system after the first break-in, so the attacker does not need to break in again.

From Flaw to Foothold: How a Web Shell Gets Used

MITRE gives no fixed order, but its list of known users shows a common one. Agrius, for example, typically deploys a variant of the ASPXSpy web shell after initial access by exploitation. The steps below follow that order.

One Web Shell, Start to Finish
  1. A flaw is foundThe attacker finds a weakness in an internet-facing web application or runtime.Technique T1190 (MITRE ATT&CK, opens in a new tab)
  2. The script is plantedA web script is written into an openly accessible folder on the web server.Technique T1505.003 (MITRE ATT&CK, opens in a new tab)
  3. The client connectsA client tool, such as the China Chopper client, talks to the script.
  4. Commands runThe web server process starts command shells or script interpreters on the host.Technique T1059 (MITRE ATT&CK, opens in a new tab)
  5. Access staysMITRE calls it persistent access. The script can stay until someone removes it.

Why Can a Patched Server Still Be Controlled?

MITRE says a web shell is placed on an openly accessible web server, and it can give its owner command execution on that server. A server patched after an intrusion could still be controlled if a web shell was left behind.

How Can You Detect a Web Shell?

MITRE lists detection ideas that focus on behavior on the server.

  • Watch for unexpected files being created in web directories, followed by the web server starting command shells or script interpreters.
  • Watch for unauthorized script files appearing in standard web folders, followed by system utilities being run.
  • Alert when a web server starts unusual processes after a file upload into a normal web directory.

Which Two Mitigations Does MITRE Give?

MITRE gives two mitigations.

  • Disable or remove risky features. MITRE gives the example of the PHP eval() function, which may be abused for web shells.
  • Use user account management and least privilege. Restrict permissions so that only authorized users can change web directories. This reduces the chance that an unauthorized shell can be placed there.

Is a Web Shell the Same as a Backdoor?

Not exactly. A backdoor is the general idea of a hidden way into a system. MITRE describes a web shell as one way to get persistent backdoor access, specifically through a script on a web server.

Is a Web Shell the Same as a Normal Command Shell?

No. A command shell is a text interface on a computer. A web shell is a web script that gives an attacker that kind of control on a web server, from a distance.

Also Called.

  • Namewebshell
  • Nameweb backdoor script

Questions.

  • What is a web shell?

    A web shell is a web script placed on an openly accessible web server. MITRE says it lets an adversary use the server as a gateway into a network, and it can provide command execution or remote shell functions.

  • How does a web shell work?

    MITRE says a web shell may have a client interface program used to talk to the web server, such as the China Chopper client. The script on the server is the server part, and the attacker's tool talks to it.

  • Why do attackers use web shells?

    MITRE says adversaries use web shells to keep a persistent backdoor. A backdoor is a hidden way back into a system, so the attacker does not need to break in again.

  • How can you detect a web shell?

    MITRE's detection ideas focus on server behavior: unexpected files created in web directories, unauthorized scripts in standard web folders, and a web server starting command shells or unusual processes after a file upload.

Sources

  1. 1 Server Software Component: Web Shell (T1505.003), MITRE ATT&CK
  2. 2 Exploit Public-Facing Application (T1190), MITRE ATT&CK
  3. 3 Command and Scripting Interpreter (T1059), MITRE ATT&CK
  4. 4 Server Software Component (T1505), MITRE ATT&CK

Keep Exploring.

Knowledge Hub
Technique Server Software Component: Web Shell (T1505.003) A web shell is a small script that an attacker places on a web server. Open Glossary term MITRE ATT&CK MITRE ATT&CK is a globally-accessible knowledge base of adversary tactics and techniques based on real-world observations. Open Glossary term Backdoor A backdoor is an undocumented way of gaining access to a computer system, and NIST says it is a potential security risk. Open Malware China Chopper China Chopper is a small web shell that attackers place on a web server to get remote access to it. Open

Browse The Library.