Security+ ยท 2.0 Threats
Web shell
A small script uploaded to a web server that lets an attacker run shell commands via HTTP requests. Classic form: a PHP file that does `system($_GET['cmd'])`.
How this shows up at NCAE
The competition web app may ship with an uploaded web shell, or the red team will plant one via an exploit. Audit /var/www/ for unfamiliar .php files, especially in uploads/ or tmp/ directories.