NCAE Mapping Hub
Security+ ยท 2.0 Threats

Web shell

A small script uploaded to a web server that lets an attacker run shell commands via HTTP requests. Classic form: a PHP file that does `system($_GET['cmd'])`.

How this shows up at NCAE

The competition web app may ship with an uploaded web shell, or the red team will plant one via an exploit. Audit /var/www/ for unfamiliar .php files, especially in uploads/ or tmp/ directories.