Blade: A webshell connection tool with customized WAF bypass payloads
Blade is a webshell connection tool based on console, currently under development and aims to be a choice of replacement of Chooper. Chooper is a very cool webshell client with...
Category: Web Maintaining Access
shellcomm-php: Communicate with a remote shell easily
ShellComm is a simple interactive CLI remote shell communicator. Sometimes, during a pentest, you get to upload a shell but you can’t upload a heavy, complex one for whatever reason. In...
LDAP credentials collector backdoor generator
LDAP-credentials-collector-backdoor-generator Idea About This script Last year, during external network VAPT of a client I got inside the network using vulnerable web application. Once I was inside, I observed there...
b374k: PHP Webshell with handy features
b374k PHP Webshell This PHP Shell is a useful tool for system or web administrator to do remote management without using cpanel, connecting using ssh, ftp etc. All actions take place...
WPForce: WordPress Attack Suite
WPForce – WordPress Attack Suite ABOUT: It is a suite of WordPress Attack tools. Currently, this contains 2 scripts – WPForce, which brute forces logins via the API, and Yertle,...
PENTEST-WIKI: free online security knowledge library for pentesters/researchers
PENTEST-WIKI is a free online security knowledge library for pentesters / researchers. If you have a good idea, please share it with others. Contents Contents Network Analysis IP Whois DNS...
LFI Suite 1.13 released: Totally Automatic LFI Exploiter (+ Reverse Shell) and Scanner
LFI Suite is a totally automatic tool able to scan and exploit Local File Inclusion vulnerabilities using many different methods of attack, listed in the section Features. Features Works with Windows, Linux...
CVE-2016-3088: Apache ActiveMQ < 5.14.0 web shell upload
Apache ActiveMQ Apache ActiveMQ ™ is the most popular and powerful open source messaging and Integration Patterns server. Apache ActiveMQ is fast, supports many Cross Language Clients and Protocols, comes with easy to use Enterprise...
PHP-backdoors: collection of PHP backdoors
PHP-backdoors A collection of PHP backdoors. For educational and/or testing purposes only. Notes The deobfuscated folder does not necessarily contain deobfuscated versions of the backdoors you can find in the...
[Bypass WAF] Php webshell without numbers and letters
Normally, you often write webshell that includes numbers and letter like below: For bypass WAF, you can use some techniques to re-write your webshell. Idea First, clear ideas. My core...
snodew: PHP root (suid) reverse shell
snodew is a PHP reverse shell backdoor which uses a small suid binary to escalate privileges on connection snodew is made mainly to work alongside vlany but can also be setup as...
shellstack: Manage All Your Backdoored Websites Efficiently
ShellStack is a PHP based backdoor management tool. This Tool comes handy for “HACKERS” who wish to keep a track of every website they hack. The tool generates a backdoor...
cheetah | brute force webshell password tool
Cheetah is a dictionary-based brute force password webshell tool, running as fast as a cheetah hunt for prey. Cheetah’s working principle is that it can submit a large number of...
DAws: Advanced Web Shell
There are multiple things that make DAws better than every Web Shell out there: Bypasses Security Systems(IPS, WAFs, etc) like Suhosin(uses up to 20 php functions just to get a...
Weevely tutorial: from basic to advance PHP web shell
Weevely is a webshell management tool written in python. Weevely tutorial article describes from basic to advance its most function on your penetration testing. Weevely is available on Kali Linux....
