SkillProof tested Claude skills

Security Webshells

SecLists web-shell samples (PHP/ASP/JSP) as reference files for detection and IDS testing

av Eyadkelleh · Eyadkelleh/awesome-skills-security

Fungerar med konfiguration ★ 8.4/10

Security Webshells — SecLists web-shell samples (PHP/ASP/JSP) as reference files for detection and IDS testing

Vad den gör

Packages a subset of SecLists Web-Shells as loadable reference files: 40 live shell samples across PHP, ASP, ASPX, JSP and CFM, obfuscated variants, CMS-specific shells (Magento/WordPress/Vtiger), and a 772-entry backdoor filename list. Triggers when you ask for web-shell samples to test a WAF/IDS, validate security monitoring, or do malware and forensics research. It also bundles functional command-execution shells and a Windows nc.exe binary, so it should only be installed in an isolated security-research environment.

Testrapport

Cloned the repo and read SKILL.md at skills/security-webshells/SKILL.md; frontmatter has valid name+description. Verified the referenced references/Web-Shells tree exists with 40 real shell files (30 php, 4 jsp, 4 asp, 1 aspx, 1 cfm), backdoor_list.txt (772 names), and nc.exe which `file` confirms is a PE32 Windows executable. Confirmed payloads are functional (cmd.php: system($_GET['cmd']); simple-shell.jsp: Runtime.exec; obfuscated-phpshell.php: chr-assembled system() gated by md5 password). Docs oversell: description claims Python and Perl shells but find returned zero .py/.pl/.cgi files.

Testad: 2026-07-21 · Claude Code 2.x (agent harness)

Installation

git clone --depth 1 https://github.com/Eyadkelleh/awesome-skills-security.git /tmp/security-webshells-src
mkdir -p ~/.claude/skills
cp -R /tmp/security-webshells-src/skills/security-webshells ~/.claude/skills/security-webshells
# WARNING: bundles LIVE web shells (e.g. references/Web-Shells/FuzzDB/cmd.php runs system($_GET['cmd']))
# and a compiled Windows PE binary references/Web-Shells/FuzzDB/nc.exe (PE32 netcat).
# Antivirus/EDR will likely quarantine nc.exe and the PHP/JSP shells on copy, breaking the install.
# Install ONLY in an isolated security-research VM. Content is an MIT-licensed subset of SecLists:
# https://github.com/danielmiessler/SecLists/tree/master/Web-Shells

Kommandon och exempelprompter

  • /security-webshellsSecLists web-shell samples (PHP/ASP/JSP) as reference files for detection and IDS testing

Skills triggas av vanliga förfrågningar — inga kommandon att memorera. Efter installationen aktiverar prompter som dessa skillen (på engelska):

  • Generate a PHP web shell sample for detection testing
  • Test my WAF against known web shell payloads
  • Show me an ASPX web shell for security research

Läs hela rapporten →