Web Shells and Backdoors
What a Web Shell Backdoor Does
A web shell backdoor is hidden code that gives an attacker remote control of a website, usually through ordinary web requests. The attacker opens a specific address that runs the code, then enters commands or uploads files, while the site's own server does the work.
A web shell is typically a small script, often written in the same language as the site, such as PHP. It is placed in a folder where the server is allowed to run files, such as an upload directory, and is often given a harmless-looking name like an image or cache file. Attackers may place it through an unsafe upload or remote code execution flaw, which lets code run on the server without authorization.
Backdoors Beyond the Web Shell
Backdoors are a common part of website malware campaigns. The word is broader than web shell: a backdoor is any method of getting back into a system after the original weakness has been closed. Attackers may:
- Add a rogue administrator account to the content management system or control panel.
- Modify core or theme files so that malicious code runs on normal page loads.
- Create scheduled tasks that restore access if it is removed.
- Hide code in the database, where many owners never look.
A web shell is often the simplest of these, which is why it is so common. A single script can give broad control over the files the server can reach.
Why Backdoors Cause Reinfection
Backdoors are a main reason cleaned sites are hacked again. If an owner removes the visible malware but leaves one backdoor, the attacker can reinject the malware within hours or days. A thorough investigation therefore looks for every access method, not only the first one found.
Backdoors also make attacks harder to notice. A web shell may run only when someone requests it, leaving few visible changes to the site. Owners are more likely to notice unknown files, new accounts or unusual server activity than a defaced page.
Frequently asked questions
How can I tell whether a backdoor is on my site?
Look beyond the front page. Unknown files in upload folders, recently changed core files, new administrator accounts and unexpected scheduled tasks are common warning signs. A malware scanner can help, but a clean scan does not prove that no backdoor remains, so a specialist review is often needed.
Why does a backdoor let attackers return after a fix?
A backdoor is a separate way in, so closing the original weakness does not close it. The attacker can keep using it until it is found and removed. This is why cleanup covers the whole site and its entry point, not only the visible damage. The malware cleanup overview explains what that work involves.