Open In App

What are Web Shells?

Last Updated : 30 Mar, 2023
Improve
Improve
Like Article
Like
Save
Share
Report

A web shell is a malicious program that is used to access a web server remotely during cyberattacks. It is a shell-like interface that is used by hackers to access an application that has been hacked via some predefined phishing methods. A web shell in itself isn’t capable of attacking the entire server, hence it is always used in conjunction with some other technique during the post-exploitation stage.

It can be written in any server-side programming language like PHP etc. Web shells are increasingly being used these days because they are difficult to trace and can be used for a lot of purposes.

Working

To access a remote server, the attacker finds a location for the delivery of the web shell. The attacker looks for the vulnerabilities in the system that can act as host sites and delivers the web shell at that location.

Once a web shell has been delivered successfully, it can be used to issue shell commands to perform the required tasks. The attacker might be able to upload, delete, download, and execute files.

Web shells are commonly used in:

  • Infecting website users with malware using the watering hole approach, which is a computer attack strategy in which an attacker guesses or observes which websites an organization often visits and infects one or more of them.
  • Brand defacement by modifying files inappropriately.
  • Distributed denial of service (DDoS) attack.
  • To transmit commands within the network that isn’t accessible via the Internet.
  • Acting as a command and control base to be used for attacking other external networks.

Types of Web Shells

1. Bind Shell: Bind Shell is a type of shell that is installed on the target device. It gets binded to a certain port on the host and listens for incoming connections to the device. The hacker can then access this web shell remotely and use it to execute scripts on the target host. 
 

Bind Shell

2. Reverse Shell: A reverse shell is also known as a ‘Connect-Back Shell’. The hackers are required to look for a remote command execution vulnerability and exploit it for the delivery of the web shell. Unlike bind shell, the target host connects back to the hacker’s device which it listens for an incoming connection.

Reverse Shell

3. Double Reverse Shell: A double reverse shell is a special case of the reverse shell. The target host connects back to the hacker’s device which was already listening for an incoming connection. However, in this case, there are two different ports that connect back to the hacker’s device. The input and output traffic is separated into two different channels.

Double Reverse Shell

How do hackers use web shells?

In order to use a web shell, the attacker first finds out a vulnerable point in the system where a web shell can be delivered. They are usually installed by exploiting the vulnerabilities of the server or server configurations. This may include:

  • Vulnerabilities in applications, file systems, and services.
  • Vulnerabilities in remote file inclusion (RFI) and local file inclusion (LFI).
  • Remote code execution.
  • Exposed administration interfaces.

Once a web shell is successfully installed, the attacker can use it to run scripts remotely on the target host which can provide him access to the sensitive information stored in the organization’s servers.

Detection

The following indicates that a web shell might be present in the system –  

  • Very high server usage (happens because the hacker usually uploads and downloads a very large amount of data )
  • The wrong timestamp on the files.
  • Presence of alien files at the server.
  • Files having suspicious names.
  • Presence of unknown connections at the server-side logs.

Prevention and Mitigation

To avoid the installation of a web shell, the following precautions could be stepped out:

  • Prompt patching of web server and plugin vulnerabilities: The idea is to fix the vulnerabilities of the system by patching it as soon as possible. This will reduce the attack surface for the hackers to exploit.
  • Reduce the use of plug-ins:  This will reduce the vulnerabilities of the system. Reducing the number of plugins would reduce the number of potential attack surfaces present at the server.
  • File Integrity Monitoring: This continuously monitors the files stored at the server-side and removes the ones that are unrecognized. Since, a web shell needs to reside in the code directory of the webserver, therefore, deleting the file would render it useless.
  • Malware scanning/endpoint protection software: Scan the stored server-side files using malware detection software to discover malware stored. However, this method is not very reliable as a web shell script looks like a genuine script.
  • Republish the Application from the source:  A thorough check of the application’s codebase is not possible at the server-side without developer aid. Hence, in order to detect unexpected files in the codebase, republish them after wiping them entirely from the development environment.
  • Network segmentation prevents lateral movement: Avoid hackers from accessing the whole network by lateral traversal by segregating the network segments.
  • Server configuration review and hardening: Identify and rectify vulnerabilities in both the application server and the operating systems by running a full server configuration check.
  • Mitigate Remote file inclusion (RFI) and local file inclusion (LFI) vulnerabilities: Validate user input data before sending it to mitigate Remote file inclusion (RFI) and local file inclusion (LFI) vulnerabilities.
  • Deploy a firewall: Use specialized firewalls like Web Application Firewall (WAF) that are designed specifically for the prevention of injection of web shells in the system.

Similar Reads

Difference between Deep Web and Dark Web
Prerequisite - Deep web, Dark web, and DarkNet Deep Web: It is the web that cannot be accessed by the search engines, like government private data, bank data, cloud data, etc. These data are sensitive and private, so kept out of reach. It is used to provide access to a specific group of people. On the dark Web, users do intentionally bury data. Dar
3 min read
What’s difference between The Internet and The Web ?
Do many folks consider that they both are the same but are they really the same? The Internet is a global network of networks while the Web, also referred to formally as World Wide Web (www) is a collection of information that is accessed via the Internet. Another way to look at this difference is; the Internet is infrastructure while the Web is se
2 min read
Web Caching and Conditional GET Statements
Web caching is done by a Proxy Server - an intermediate entity between the original server and the client. When a client requests for some information (through an HTTP message), it goes through the proxy server, which - First checks if it has the copy locally stored. If it has, then it forwards the result directly to the client. Otherwise, it queri
2 min read
Core Defences Mechanism in Web Applications
We divide core defences in web applications into three areas: Handling User Access, Handling User Input, and Handling Attackers. These are explained as following below. 1. Handling User Access: First task is to handle access according to user (admin user, anonymous user, normal user). Most web applications handle access using a trio (I named it as
6 min read
Web Scripting and its Types
The process of creating and embedding scripts in a web page is known as web-scripting. A script or a computer-script is a list of commands that are embedded in a web-page normally and are interpreted and executed by a certain program or scripting engine. Scripts may be written for a variety of purposes such as for automating processes on a local-co
2 min read
Difference between Static and Dynamic Web Pages
Static Web pages: Static Web pages are very simple. It is written in languages such as HTML, JavaScript, CSS, etc. For static web pages when a server receives a request for a web page, then the server sends the response to the client without doing any additional process. And these web pages are seen through a web browser. In static web pages, Pages
2 min read
How world-wide-web (www) is different from the Internet ?
Before answering the question of how www is different from the Internet? First, let's understand what does Internet means? According to Wikipedia, the definition of the Internet is: The Internet (a portmanteau of the interconnected network) is the global system of interconnected computer networks that uses the Internet protocol suite (TCP/IP) to li
2 min read
Web Jacking
Illegally seeking control of a website by taking over a domain is known as Web Jacking. In web jacking attack method hackers compromises with the domain name system (DNS) that resolves website URL to IP address but the actual website is never touched. Web jacking attack method is another type of social engineering phishing attack where an attacker
3 min read
Difference Between Data Science and Web Development
Data Science: Data science is the field of study that combines domain expertise, programming skills, and knowledge of mathematics and statistics to extract meaningful insights from data. Data science practitioners apply machine learning algorithms to numbers, text, images, video, audio, and more to produce artificial intelligence (AI) systems to pe
3 min read
Types of Web Hosting
Web Hosting is a service that allows hosting/post-web-server applications( website or web page ) on a computer system through which web-browser clients can have easy access to electronic content on the Internet. Web Server or Web Host is a computer system that provide web hosting. When Internet user's want to view your website, all they need to do
3 min read