What is this?
It's a community collection of webshells - scripts that give you control of a web server once uploaded - covering all the common server-side languages and maintained by tennc with 10k+ stars.
It's a community collection of webshells - scripts that give you control of a web server once uploaded - covering all the common server-side languages and maintained by tennc with 10k+ stars.Is it a tool I can run, or just a pile of files?It's not an application - it's a repository of ready-made shell scripts sorted by language: asp, aspx, php, jsp, jspx, pl and py. You pick the one that matches your target server.
It's not an application - it's a repository of ready-made shell scripts sorted by language: asp, aspx, php, jsp, jspx, pl and py. You pick the one that matches your target server.How do I get it?Clone the repo, or grab a packaged download from the GitHub releases page.
Clone the repo, or grab a packaged download from the GitHub releases page.How do I actually use one of these shells?Upload the shell to the server you are testing, then connect to it from a management client - the README recommends ones like China Chopper, AntSword, Behinder, Godzilla and Weevely.
Upload the shell to the server you are testing, then connect to it from a management client - the README recommends ones like China Chopper, AntSword, Behinder, Godzilla and Weevely.Are the shells safe to use?There is no backdoor guarantee: the author says he cannot vouch for shells he did not upload himself, so treat third-party files as untrusted until you have reviewed the code.
There is no backdoor guarantee: the author says he cannot vouch for shells he did not upload himself, so treat third-party files as untrusted until you have reviewed the code.Is it OK to use these shells on any server I find?No - the README restricts the tools to testing, explicitly forbids illegal activity, and states the author bears no responsibility for any consequences of their use.
No - the README restricts the tools to testing, explicitly forbids illegal activity, and states the author bears no responsibility for any consequences of their use.What should I do if I find backdoor code in one of the shells?Report it via a GitHub issue. The author also asks anyone submitting a shell not to add backdoors and not to rename the files or change their passwords.
Report it via a GitHub issue. The author also asks anyone submitting a shell not to add backdoors and not to rename the files or change their passwords.What is webshell-venom?A companion project by yzddmr6 that endlessly generates AV-evading webshells, including one-liner shells, built to bypass D Shield, SafeDog, Hippo and other WAF/AV scanners.
A companion project by yzddmr6 that endlessly generates AV-evading webshells, including one-liner shells, built to bypass D Shield, SafeDog, Hippo and other WAF/AV scanners.Are there other webshell collections worth knowing about?Yes - the README links about 20 related projects, such as JohnTroony/php-webshells, BlackArch/webshells, LandGrey/webshell-detect-bypass and WangYihang/Webshell-Sniper.
Yes - the README links about 20 related projects, such as JohnTroony/php-webshells, BlackArch/webshells, LandGrey/webshell-detect-bypass and WangYihang/Webshell-Sniper.What are similar projects?bug-bounty-hunting-prompts, Claude-Red, CVE-2026-62911, Decepticon, evilginx2, SecLists, CVE-2026-41940-PoC, nikto
bug-bounty-hunting-prompts, Claude-Red, CVE-2026-62911, Decepticon, evilginx2, SecLists, CVE-2026-41940-PoC, niktoWhich topics is it in?waf, perl, hacking-tools, anti-detection, redteam, pentest, web-server, security-research, offensive-security, collection, pentesting, penetration-testing
waf, perl, hacking-tools, anti-detection, redteam, pentest, web-server, security-research, offensive-security, collection, pentesting, penetration-testing