Web Shells: How Attackers Use Them and How to Detect and Remove Them

Summary

An overview of web shells as persistent backdoors on compromised servers, covering common entry methods, capabilities and risks, plus ways to detect, remove and prevent them.

Key points

• Web shells are malicious scripts or code that provide attackers remote access to compromised web servers and can maintain persistence.
• They may be introduced through exploited vulnerabilities, unsafe file uploads, misconfigurations, or stolen credentials.
• Attackers can use web shells to run commands, access files and databases, steal credentials or data, and install further malware.
• Shells may be standalone files or hidden in legitimate application files, plugins, server modules, or configuration.
• Detection signals include unfamiliar scripts, anomalous web traffic, suspicious server processes, unexpected outbound connections, and unexplained file changes.
• Response guidance includes isolating the server, investigating the initial access and persistence, removing malicious components, restoring clean files, patching, and rotating passwords.
• The article reports that Sucuri scans identified publicly accessible interfaces of known web shells 16,978 times in 2024.

Vendors