# Analyzing Webshells

> Analyzes suspected webshells (PHP, ASPX/ASP, JSP) by detecting dynamic-execution

- **Type:** Skill
- **Install:** `agentstack add skill-meltedinhex-analyst-ai-pack-analyzing-webshells`
- **Verified:** Pending review
- **Seller:** [meltedinhex](https://agentstack.voostack.com/s/meltedinhex)
- **Installs:** 0
- **Category:** [Agent Skills](https://agentstack.voostack.com/c/agent-skills)
- **Latest version:** 0.1.0
- **License:** Apache-2.0
- **Upstream author:** [meltedinhex](https://github.com/meltedinhex)
- **Source:** https://github.com/meltedinhex/analyst-ai-pack/tree/main/skills/analyzing-webshells
- **Website:** https://meltedinhex.com/

## Install

```sh
agentstack add skill-meltedinhex-analyst-ai-pack-analyzing-webshells
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Analyzing Webshells

## When to Use

- You found a suspicious server-side script (`.php`, `.aspx`, `.jsp`, `.asp`) and need to confirm
  it is a webshell and understand its command interface.
- You are triaging a web-server compromise and want to classify dropped scripts.

**Do not use** a live web server to execute the script to "test" it — that runs attacker code.
Analyze the source statically.

## Prerequisites

- The suspect script file(s), read inertly.

## Safety & Handling

- Read the file statically; never deploy or request it on a live server. Defang any URLs.

## Workflow

### Step 1: Detect execution sinks and input flow

```bash
python scripts/analyst.py scan shell.php
```

Flags dynamic-execution sinks (`eval`, `assert`, `system`, `exec`, `passthru`, `Runtime.exec`,
ASPX `eval()`/`Process.Start`) and whether request input (`$_GET`/`$_POST`/`Request`) reaches them.

### Step 2: Identify obfuscation/encoder chains

Detects `base64_decode`, `gzinflate`, `str_rot13`, `eval(chr(...))`, hex `\x` strings, and
`FromBase64String` chains commonly wrapping the payload.

### Step 3: Decode obvious layers

Apply base64/rot13/gzinflate where present to reveal the inner command interface (best-effort,
non-executing).

### Step 4: Classify and report

Note the language, the password/parameter gate (if any), and capabilities (file manager, command
exec, SQL, upload); defang IOCs.

## Validation

- A flagged file pairs an execution sink with attacker-controlled input.
- Encoder chains are identified and, where safe, decoded statically.
- Capability classification is backed by concrete code evidence.

## Pitfalls

- Legitimate admin tools that also use `eval`/`system` — corroborate with input flow.
- Multi-stage shells that fetch the real logic remotely.
- Deeply nested or runtime-built obfuscation that static decode only partly unwinds.

## References

- See [`references/api-reference.md`](references/api-reference.md) for the scanner.
- ATT&CK T1505.003 (linked in frontmatter).

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [meltedinhex](https://github.com/meltedinhex)
- **Source:** [meltedinhex/analyst-ai-pack](https://github.com/meltedinhex/analyst-ai-pack)
- **License:** Apache-2.0
- **Homepage:** https://meltedinhex.com/

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** yes

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: flagged — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-meltedinhex-analyst-ai-pack-analyzing-webshells
- Seller: https://agentstack.voostack.com/s/meltedinhex
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.