Anatomy of a WebShell
Talkat AppSec California 2014 · on Tuesday, 2014-01-28· at 10:30· Track 3, Annenberg Community Beach House, East Pacific Coast Highway·
summary
WebShells come in three concrete classes — eval-based tiny backdoors, admin/full-featured backdoors, and proxy exfiltration via XMLHttpRequest — with proxies often attributed to nation‑state actors and shells lying dormant for months. Detection strategies are specific: file integrity monitoring that opens and scans changed files, log analysis (the Omens log scanner is an example), NetFlow and network monitors to spot a web server behaving like a client, honeypots, and signatures for base64 or unusual percent‑encoding in requests.
AI-written summary · about
chapters (10)
- 0:00Intro
- 2:20Three Different Ones (EVAL)
- 5:37Three Different Ones (Admin)
- 6:09Three Different Ones (Proxy)
- 7:30Why Should We Care
- 9:21What Makes Them Work
- 10:33Web Security - Or Lack Thereof
- 13:08Trojanized or Standalone
- 14:48Persistence and Stealth
- 16:44WebShells You'll Know What To Look For...
related talks
26mHunting for log4shell Compromises
42mModern web application bugs
53mHow hacking works - Web edition
46m📕 CloudShell Hide-n-Seek: enjoying the sweet persistent sounds of silence! 🔥
40mHow hacking works; Web edition
47mReversing Engineering a Web Application - For Fun, Behavior & WAF Detection
32mYou Can Run, but You Can't Hide - Finding the Footprints of Hidden Shellcode
44mSelected Vulnerabilities in Web Applications