Lion Cipher Lab
Detect a web shell: hunt it in your web server logs and on disk
- SOC Analyst / Blue Team
- Intermediate
- ~50 min
- Free · no account required
Why it matters
A web shell is one of the most common ways an attacker turns a single web-application bug into a durable foothold: a few lines of PHP, JSP or ASPX dropped into a web-reachable folder give them a command prompt on your server that they reach with an ordinary web request. It is the technique behind a long list of real intrusions — mass exploitation of Exchange, of file-transfer appliances, of forgotten upload forms — because it is cheap to plant, survives reboots, and blends into a directory full of legitimate web files while running as the harmless-looking web-server user. That camouflage is…
What you'll learn
- explaining what a web shell is, how it gets planted (upload flaw, RCE, stolen creds), and why it hides so well
- standing up a disposable PHP web server in Docker and generating a baseline access log
- recognising the classic web-shell code smells: system(), passthru(), shell_exec(), eval(), base64_decode() fed by $_GET/$_POST/$_REQUEST
- hunting NEW/odd files on disk with find -newer a baseline marker and find -mmin, and grepping the webroot for those code smells
- hunting the access log with grep/awk/sort/uniq -c: a never-before-seen .php endpoint, an odd User-Agent, command-looking query strings, and pivoting to the source IP
- catching the strongest signal — the web server process spawning a shell (apache2 -> sh -> whoami) — in the process tree, and knowing EDR/auditd/Falco see it
- judgment: when each signal is reliable vs noisy, why log analysis still works against an obfuscated shell, and how to combine disk+log+process and prevent
Steps in this lab
- What a web shell is, and why it is hard to spot
- The authorized, defensive framing (read this before you build anything)
- Stand up a throwaway PHP server, a normal site, and a baseline
- Simulate the compromise: drop the benign shell artifact and use it
- Hunt on disk: newest files, recent mtime, and code smells
- Hunt in the access log: the endpoint, the client, the query, the source
- The strongest signal: the web server spawns a shell
- Judgment: when each signal is reliable, and how to do better than one check
- What you built — and clean up