Attacks and malware
What is Web shell?
A malicious server-side file that lets an attacker send commands through a web server.
A web shell is a malicious script, often PHP, ASPX or JSP, placed on a web server so an attacker can run commands on it through ordinary web requests. It is both a backdoor and a form of persistence.
Web shells are usually planted after exploiting a vulnerability in an internet-facing application. They can be tiny and hide among legitimate files, so detection relies on file monitoring and on web server processes starting command shells.