PHP Kit
WSO (Web Shell by Orb)
The workhorse of the Russian webshell scene — compact, battle-tested, zero authentication on default install, and carrying a W0rm supply-chain backdoor that gives a third party unauthenticated RCE on every host the operator compromises. Five independent attack surfaces. Highest severity in corpus.
YARA 5 min readwhmcs-killer-v3
WHMCS-targeting webshell with six independent attack vectors — W0rm supply-chain RCE, trivial client-side session forgery, pre-auth file inclusion with eval, arbitrary file upload, SQL injection, and stored XSS. Every vector is pre-auth. Harvests the WHMCS billing database: client records, payment details, hosting credentials, domain registrations.
YARA 4 min readviper.php (Viper 1337)
Minimal file uploader ecosystem by Viper 1337 — multiple variants (XxX.php, 098.php, pwn.php) carrying a Hmei7-linked supply-chain beacon in base64-encoded eval blocks. One variant uses GIF89a magic-byte prefix for MIME-type evasion.
YARA 4 min readunzipper
Legitimate archive extraction utility poisoned with W0rm supply-chain injection. Pre-auth RCE on every request, dynamic C2 email via MD5-of-Pastebin, and a dedupe mechanism that reports each compromised install exactly once.
YARA 4 min readsymlink.php
cPanel privilege escalation tool using symlink traversal across account boundaries — also carrying a W0rm supply-chain injection with pre-auth RCE that fires before any of the tool's own cookie-based authentication.
YARA 4 min readStupidc0de Backdoor
The flagship Tier-2 card. 90 KB / 2030 lines — the largest tool in the corpus. Indonesian scene (Stupidc0de Family: Putra-Attacker, Daryun, Shor7cut, Osvaldas, Sinkaroid). Zero authentication on 12+ function modules. Pre-auth RCE, LFI, and arbitrary upload all confirmed live. Five runtime supply-chain remote-includes. WordPress admin reset module. zone-h mass-defacement notifier.
YARA 4 min readsmtpfu*ker
SMTP brute-force tool obfuscated with PHPJiaMi commercial packer. Tests credential lists against mail servers — the commercial obfuscation suggests the author treats this as a product, not a throwaway script.
YARA 3 min readshell-checker (selmasker)
Disguised as a webshell validation tool — but the checker is the shell. Indonesian scene (JExCoders / XploitSec-ID). Every string literal is base64-encoded to defeat grep. Hidden GET-branch backdoor accepts unauthenticated file uploads to the webroot — confirmed live. Config-trap pattern: operator fills in their own email, making every hit report to them (and to anyone reading the source).
YARA 4 min readrintod / toolol
Minimal file uploader at 330 bytes — the smallest and cleanest tool in the corpus. Indonesian scene (GitHub rintod/toolol). No backdoor, no auth, no obfuscation, no beacon in the analyzed sample — the lowest observed supply-chain risk in the corpus. Used by Flash-X as stage-0 dropper to plant full shells after initial RCE.
YARA 4 min readr57
Classic Russian webshell and one of the earliest full-featured PHP shells to circulate widely. Carries a W0rm supply-chain backdoor and a pre-auth local file inclusion on the very first line of source — the operator's tool is compromised before it even loads.
YARA 4 min readNinja
Full-featured webshell with embedded PHPMailer, a redistributor-injected JavaScript tracking beacon, and a hardcoded plaintext password. Turns every compromised server into a phishing platform while reporting the operator's activity to a third-party ad network.
YARA 4 min readMySQL-interface
Standalone web-based MySQL administration tool carrying a W0rm supply-chain backdoor. Pre-auth RCE via GET parameter fires before any panel authentication. Hardcoded panel credentials (tryag_vb/102030). A lightweight phpMyAdmin alternative poisoned by its own redistributor.
YARA 3 min readmails_grabber
Database email harvester from the Algerian scene. Two authors in one 8 KB file: SparkyDz (UI) and G-B (engine). Zero authentication. Walks every database, table, and column on the server, regex-matches email addresses, validates and deduplicates, then appends to file. Bulk mode accepts pasted lists of MySQL credentials.
YARA 4 min readm4r5-sh3ll
Indonesian-scene webshell with modern Bootstrap 4 dark UI, community-public default credentials, and eval(base64_decode()) obfuscated core. Built for the bigsecc hacker community — the most user-friendly shell in Tier 1.
YARA 3 min readIndoXploit
Indonesian-scene webshell with 10 outbound TLS-disabled connections, a W0rm supply-chain backdoor that fires on every unauthenticated visit, and trivially crackable MD5 auth. Every deployment is MITM-able and pre-auth exploitable simultaneously.
YARA 4 min readFlash-X uploaders
Two minimal uploaders (~1.7 KB each) with byte-identical hidden mail() beacons to the kit author. Attributed to XPROADSHELL / BAZOOKA, distributed by 0XNIGHTSEC. The beacons fire on every page load, invisible to the operator. Half-broken obfuscation leaks two author handles from one file. Re-skin only difference between variants.
YARA 4 min readdbkiss
Legitimate open-source database admin tool (DBKiss 1.11) with the most discreet W0rm supply-chain injection in the corpus. The backdoor hides inside a define() block and fires pre-auth at PHP parse time — before the application even starts.
YARA 4 min readDamaneDz Config Grabber
Symlink-based config grabber from the Algerian scene (DamaneDz, 2013). Zero authentication. Creates a permissive directory with .htaccess override, then symlinks ~120 well-known CMS and billing config paths to harvest credentials across shared-hosting tenants.
YARA 3 min readcpanel_cracker
Misnamed config grabber — no brute-force logic exists despite the name. Malaysian scene (Donnazmi / AnonGhost, 2014). Default page load returns /etc/passwd without authentication. Stealth-404 evasion blocks search engine crawlers. Symlink grabber targets ~120 CMS and billing config paths.
YARA 4 min readc99
The original webshell — attributed to locus7s / Locus7 group. Ships with zero authentication by default and a cookie-driven PHP object injection that gives any visitor full control. The ancestor of the modern PHP shell ecosystem.
YARA 4 min readb374k
Gold standard compact webshell with anti-bot 404 evasion. Returns a fake 404 page to automated scanners while serving the real shell to interactive browsers. W0rm supply-chain infected in redistributed copies.
YARA 4 min readAlfa3
The kit's 'alfa3.php' is not a separate, older 'alfa3' family — it is an Alfa Shell V4 'Tesla' build, with the Hmei7 mail() surveillance beacon and create_function obfuscation. It is a distinct file from alfav4-tesla.php (different hash and size), not a byte-identical copy.
YARA 4 min readAlfa Shell V4 "Tesla"
The most deployed variant of the Alfa webshell family. Full-featured control panel with file manager, database browser, and CGI backdoor installer — and a hidden mail() beacon that reports every compromised host back to the kit author.
YARA 5 min read0byt3m1n1-V2
File manager webshell v2.2 with zero authentication and a runtime supply-chain dropper. Indonesian scene (zerobyte-id). No password, no session, no token — every function is open to any visitor. On every page load, fetches its own source from a hardcoded GitHub URL and writes it to the webroot.
YARA 4 min read