# security-webshells

A set of PHP, ASP, ASPX, JSP, Python and Perl web shell samples for testing detection systems and analysing malware.

- skill · `type=skill` · Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, OpenCode · 539 installs · ★ 393
- Author: Eyadkelleh
- License: not stated · policy=link-only · description only; the file stays with the author
- Source: https://github.com/Eyadkelleh/awesome-skills-security/tree/HEAD/skills/security-webshells/SKILL.md
- Updated: 2026-06-08
- HTML: https://affpapa.org/en/nevibecode/skills/security-webshells

## What it does

The skill drops a curated slice of the SecLists Web-Shells collection into your agent's context. Five groups sit inside: PHP, ASP/ASPX, JSP, Python and Perl. Reach for it when you are tuning IDS/IPS signatures, checking whether your monitoring catches a shell upload, or walking through a sample in a sandbox.

There is no runtime here. These are reference files, and the agent reads them to help you build a test or annotate a sample. Nothing extra to install beyond the skill itself.

The samples are live malware, so run them on your own box or an isolated lab only. The author spells out the allowed ground: authorised pentesting with written permission, in-scope bug bounty work, CTFs, classroom demos. Everything else is off the table. If you cannot point to who approved the test, skip this one.

## Install

### Claude Code (native platform)

1. **Skills CLI (Vercel)**
```bash
npx skills add Eyadkelleh/awesome-skills-security --skill security-webshells -a claude-code
```

2. **Manually: put the files in place**
- File: `~/.claude/skills/security-webshells/SKILL.md` — Copy the whole skill folder; for one project use .claude/skills/security-webshells/

### Codex

1. **Skills CLI (Vercel)**
```bash
npx skills add Eyadkelleh/awesome-skills-security --skill security-webshells -a codex
```

2. **Manually: put the files in place**
- File: `.agents/skills/security-webshells/SKILL.md` — For all projects use ~/.agents/skills/

### Cursor

1. **Skills CLI (Vercel)**
```bash
npx skills add Eyadkelleh/awesome-skills-security --skill security-webshells -a cursor
```

2. **Manually: put the files in place**
- File: `.cursor/skills/security-webshells/SKILL.md` — Cursor also reads .agents/skills/ and .claude/skills/

### GitHub Copilot

1. **GitHub CLI**
```bash
gh skill install Eyadkelleh/awesome-skills-security security-webshells
```

2. **Manually: put the files in place**
- File: `.github/skills/security-webshells/SKILL.md`

### Gemini CLI

1. **Skills CLI (Vercel)**
```bash
npx skills add Eyadkelleh/awesome-skills-security --skill security-webshells -a gemini-cli
```

2. **Platform CLI**
```bash
gemini skills install https://github.com/Eyadkelleh/awesome-skills-security --path skills/security-webshells
```

### Windsurf (Devin Desktop)

**Manually: put the files in place**
- File: `.devin/skills/security-webshells/SKILL.md` — The legacy .windsurf/skills/ path still works

### OpenCode

**Skills CLI (Vercel)**
```bash
npx skills add Eyadkelleh/awesome-skills-security --skill security-webshells -a opencode
```

### Claude.ai

**Claude.ai**
- Zip the folder and upload it in Settings → Capabilities → Skills

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/Eyadkelleh/awesome-skills-security/tree/HEAD/skills/security-webshells/SKILL.md

## When to use it
- check whether an IDS signature fires on a PHP shell upload
- annotate a web shell sample for an incident report
- build a lab target for file-system monitoring tests
- write a web exploitation challenge for a CTF
- compare how JSP and ASPX shells are structured

## Example prompts
- List the files in the security-webshells skill and group them by language
- Take a PHP sample from the skill and explain which WAF rules would catch it
- Build a monitoring test checklist from the samples in security-webshells

## Similar
- [fix-security-vulnerabilities-with-strix](https://affpapa.org/en/nevibecode/skills/fix-security-vulnerabilities-with-strix.md) — skill · 15700 installs
- [pentestify-security-report-generator](https://affpapa.org/en/nevibecode/skills/pentestify-security-report-generator.md) — skill · 747 installs
- [avast-premium-security-malware-analysis](https://affpapa.org/en/nevibecode/skills/avast-premium-security-malware-analysis.md) — skill · 1100 installs
- [macos-security-bypass](https://affpapa.org/en/nevibecode/skills/macos-security-bypass.md) — skill · 3500 installs
- [remediating-with-aws-security-agent](https://affpapa.org/en/nevibecode/skills/remediating-with-aws-security-agent.md) — skill · 1500 installs
- [owasp-top-10-testing](https://affpapa.org/en/nevibecode/skills/owasp-top-10-testing.md) — skill · 12800 installs

From the same set: [eyadkelleh/awesome-skills-security](https://affpapa.org/en/nevibecode/by/eyadkelleh/awesome-skills-security.md) — 6 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md