SherbyNet - /page/wikibook/entry.mu

Micron Document

<!DOCTYPE html>

<title>Web shell</title>

</head>

Web shell

</h1>

</header>

A web shell is a <a href="Shell_(computing)" title="Shell (computing)">shell-like interface</a> that enables a <a href="Web_server" title="Web server">web server</a> to be remotely accessed, often for the purposes of <a href="Cyberattack" title="Cyberattack">cyberattacks</a>.<a href="#cite_note-techtarget.com-1">[1]</a> A web shell is unique in that a <a href="Web_browser" title="Web browser">web browser</a> is used to interact with it.<a href="#cite_note-us-cert.gov-2">[2]</a><a href="#cite_note-auto-3">[3]</a>

A web shell could be programmed in any <a href="Programming_language" title="Programming language">programming language</a> that is supported on a server. Web shells are most commonly written in <a href="PHP" title="PHP">PHP</a> due to the widespread usage of PHP for <a href="Web_application" title="Web application">web applications</a>. Though <a href="Active_Server_Pages" title="Active Server Pages">Active Server Pages</a>, <a href="ASP.NET" title="ASP.NET">ASP.NET</a>, <a href="Python_(programming_language)" title="Python (programming language)">Python</a>, <a href="Perl" title="Perl">Perl</a>, <a href="Ruby_(programming_language)" title="Ruby (programming language)">Ruby</a>, and <a href="Unix_shell" title="Unix shell">Unix shell</a> scripts are also used.<a href="#cite_note-techtarget.com-1">[1]</a><a href="#cite_note-us-cert.gov-2">[2]</a><a href="#cite_note-auto-3">[3]</a>

Using <a href="Network_monitoring#Notable_network_monitoring_tools" title="Network monitoring">network monitoring tools</a>, an attacker can find <a href="Vulnerability_(computing)" class="mw-redirect" title="Vulnerability (computing)">vulnerabilities</a> that can potentially allow delivery of a web shell. These vulnerabilities are often present in applications that are run on a web server.<a href="#cite_note-us-cert.gov-2">[2]</a>

An attacker can use a web shell to issue shell commands, perform <a href="Privilege_escalation" title="Privilege escalation">privilege escalation</a> on the web server, and the ability to <a href="Upload" title="Upload">upload</a>, <a href="File_deletion" title="File deletion">delete</a>, <a href="Download" title="Download">download</a>, and <a href="Execution_(computing)" title="Execution (computing)">execute</a> files to and from the web server.<a href="#cite_note-us-cert.gov-2">[2]</a>

<div class="mw-heading mw-heading2"><h2 id="General_usage">General usage</h2></div>

Web shells are used in attacks mostly because they are multi-purpose and difficult to detect.<a href="#cite_note-us-cert.gov1-4">[4]</a> They are commonly used for:

<ul><li><a href="Data_theft" title="Data theft">Data theft</a><a href="#cite_note-us-cert.gov1-4">[4]</a></li>

<li>Infecting website visitors (<a href="Watering_hole_attack" title="Watering hole attack">watering hole attacks</a>)<a href="#cite_note-5">[5]</a></li>

<li><a href="Website_defacement" title="Website defacement">Website defacement</a> by modifying files with a malicious intent</li>

<li>Launch distributed denial-of-service (<a href="Denial-of-service_attack#Distributed_attack" title="Denial-of-service attack">DDoS</a>) attacks<a href="#cite_note-us-cert.gov-2">[2]</a></li>

<li>To relay commands inside the network which is inaccessible over the Internet<a href="#cite_note-us-cert.gov-2">[2]</a></li>

<li>To use as <a href="Botnet#Command_and_control" title="Botnet">command and control</a> base, for example as a bot in a <a href="Botnet" title="Botnet">botnet</a> system or in way to compromise the security of additional external networks.<a href="#cite_note-us-cert.gov-2">[2]</a></li></ul>

Web shells give hackers the ability to steal information, corrupt data, and upload <a href="Malware" title="Malware">malwares</a> that are more damaging to a system. The issue increasingly escalates when hackers employ compromised servers to infiltrate a system and jeopardize additional machines. Web shells are also a way that malicious individuals target a variety of industries, including government, financial, and defense through cyber espionage. One of the very well known web shells used in this manner is known as “<a href="China_Chopper" title="China Chopper">China Chopper</a>.”<a href="#cite_note-6">[6]</a>

<div class="mw-heading mw-heading2"><h2 id="Delivery_of_web_shells">Delivery of web shells</h2></div>

Web shells are installed through vulnerabilities in web application or weak server security configuration including the following:<a href="#cite_note-us-cert.gov-2">[2]</a><a href="#cite_note-us-cert.gov1-4">[4]</a>

<ul><li><a href="SQL_injection" title="SQL injection">SQL injection</a>;</li>

<li>Vulnerabilities in applications and services (e.g. <a href="Web_server" title="Web server">web server</a> software such as <a href="Nginx" title="Nginx">NGINX</a> or <a href="Content_management_system" title="Content management system">content management system</a> applications such as <a href="WordPress" title="WordPress">WordPress</a>);<a href="#cite_note-7">[7]</a><a href="#cite_note-techcrunch.com-8">[8]</a></li>

<li>File processing and uploading vulnerabilities, which can be mitigated by e.g. limiting the file types that can be uploaded;<a href="#cite_note-techcrunch.com-8">[8]</a></li>

<li><a href="File_inclusion_vulnerability" title="File inclusion vulnerability">Remote file inclusion</a> (RFI) and <a href="File_inclusion_vulnerability#Local_File_Inclusion" title="File inclusion vulnerability">local file inclusion</a> (LFI) vulnerabilities;</li>

<li><a href="Arbitrary_code_execution" title="Arbitrary code execution">Remote code execution</a>;</li>

<li>Exposed administration interfaces;<a href="#cite_note-us-cert.gov-2">[2]</a></li></ul>

An attacker may also modify (<a href="Spoofing_attack" title="Spoofing attack">spoof</a>) the <code>Content-Type</code> header to be sent by the attacker in a file upload to bypass improper file validation (validation using MIME type sent by the client), which will result in a successful upload of the attacker's shell.

<div class="mw-heading mw-heading2"><h2 id="Example">Example</h2></div>

The following is a simple example of a web shell written in PHP that executes and outputs the result of a shell command:

</pre></div>

Assuming the filename is <code>example.php</code>, an example that would output the contents of the <code><a href="Passwd#Password_file" title="Passwd">/etc/passwd</a></code> file is shown below:

<pre>https://example.com/example.php?x=cat%20%2Fetc%2Fpasswd

</pre>

The above request will take the value of the <code>x</code> parameter of the <a href="Query_string" title="Query string">query string</a>, sending the following shell command:

<div class="mw-highlight mw-highlight-lang-shell mw-content-ltr" dir="ltr"><pre>cat /etc/passwd

</pre></div>

This could have been prevented if the shell functions of PHP were disabled so that arbitrary shell commands cannot be executed from PHP.

<div class="mw-heading mw-heading2"><h2 id="Prevention_and_mitigation">Prevention and mitigation</h2></div>

A web shell is usually installed by taking advantage of vulnerabilities present in the web server's software. That is why removal of these vulnerabilities is important to avoid the potential risk of a compromised web server.

The following are security measures for preventing the installation of a web shell:<a href="#cite_note-us-cert.gov-2">[2]</a><a href="#cite_note-auto-3">[3]</a>

<ul><li>Regularly update the applications and the host server's <a href="Operating_system" title="Operating system">operating system</a> to ensure immunity from known <a href="Software_bug" title="Software bug">bugs</a></li>

<li>Deploying a <a href="DMZ_(computing)" title="DMZ (computing)">demilitarized zone</a> (DMZ) between the web facing servers and the internal networks</li>

<li>Secure configuration of the web server<a href="#cite_note-us-cert.gov-2">[2]</a></li>

<li>Closing or blocking <a href="Port_(computer_networking)" title="Port (computer networking)">ports</a> and services which are not used<a href="#cite_note-us-cert.gov-2">[2]</a></li>

<li>Using user input data validation to limit <a href="File_inclusion_vulnerability" title="File inclusion vulnerability">local and remote file inclusion vulnerabilities</a><a href="#cite_note-us-cert.gov-2">[2]</a></li>

<li>Use a <a href="Reverse_proxy" title="Reverse proxy">reverse proxy</a> service to restrict the administrative URL's to known legitimate ones<a href="#cite_note-us-cert.gov-2">[2]</a></li>

<li>Frequent vulnerability scan to detect areas of risk and conduct regular scans using web security software (this does not prevent <a href="Zero-day_(computing)" class="mw-redirect" title="Zero-day (computing)">zero day attacks</a><a href="#cite_note-us-cert.gov-2">[2]</a>)</li>

<li>Deploy a <a href="Firewall_(computing)" title="Firewall (computing)">firewall</a><a href="#cite_note-us-cert.gov-2">[2]</a></li>

<li>Disable directory browsing</li>

<li>Not using default passwords<a href="#cite_note-us-cert.gov-2">[2]</a></li></ul>

<div class="mw-heading mw-heading2"><h2 id="Detection">Detection</h2></div>

Web shells can be easily modified, so it's not easy to detect web shells and <a href="Antivirus_software" title="Antivirus software">antivirus</a> software are often not able to detect web shells.<a href="#cite_note-us-cert.gov-2">[2]</a><a href="#cite_note-fireeye.com-9">[9]</a>

The following are common indicators that a web shell is present on a web server:<a href="#cite_note-us-cert.gov-2">[2]</a><a href="#cite_note-auto-3">[3]</a>

<ul><li>Abnormal high web server usage (due to heavy downloading and uploading by the attacker);<a href="#cite_note-us-cert.gov-2">[2]</a><a href="#cite_note-fireeye.com-9">[9]</a></li>

<li>Files with an abnormal timestamp (e.g. newer than the last modification date);<a href="#cite_note-fireeye.com-9">[9]</a></li>

<li>Unknown files in a web server;</li>

<li>Files having dubious references, for example, <code>cmd.exe</code> or <code><a href="Eval" title="Eval">eval</a></code>;</li>

<li>Unknown connections in the logs of web server</li></ul>

For example, a file generating suspicious traffic (e.g. a <a href="Portable_Network_Graphics" class="mw-redirect" title="Portable Network Graphics">PNG</a> file requesting with <a href="POST_(HTTP)" title="POST (HTTP)">POST</a> parameters).<a href="#cite_note-us-cert.gov-2">[2]</a><a href="#cite_note-10">[10]</a><a href="#cite_note-11">[11]</a><a href="#cite_note-12">[12]</a> Dubious logins from DMZ servers to internal sub-nets and vice versa.<a href="#cite_note-us-cert.gov-2">[2]</a>

Web shells may also contain a login form, which is often disguised as an <a href="HTTP_error" class="mw-redirect" title="HTTP error">error page</a>.<a href="#cite_note-us-cert.gov-2">[2]</a><a href="#cite_note-13">[13]</a><a href="#cite_note-14">[14]</a><a href="#cite_note-15">[15]</a>

Using web shells, adversaries can modify the <a href=".htaccess" title=".htaccess">.htaccess</a> file (on servers running the <a href="Apache_HTTP_Server" title="Apache HTTP Server">Apache HTTP Server</a> software) on web servers to redirect <a href="Web_search_engine" class="mw-redirect" title="Web search engine">search engine</a> requests to the <a href="Web_page" title="Web page">web page</a> with <a href="Malware" title="Malware">malware</a> or <a href="Spamming" title="Spamming">spam</a>. Often web shells detect the <a href="User_agent" title="User agent">user-agent</a> and the content presented to the <a href="Search_engine_spider" class="mw-redirect" title="Search engine spider">search engine spider</a> is different from that presented to the user's browser. To find a web shell a <a href="User_agent" title="User agent">user-agent</a> change of the crawler bot is usually required. Once the web shell is identified, it can be deleted easily.<a href="#cite_note-us-cert.gov-2">[2]</a>

Analyzing the web server's log could specify the exact location of the web shell. Legitimate users/visitor usually have different <a href="User_agent" title="User agent">user-agents</a> and <a href="HTTP_referer" title="HTTP referer">referers</a>, on the other hand, a web shell is usually only visited by the attacker, therefore have very few variants of user-agent strings.<a href="#cite_note-us-cert.gov-2">[2]</a>

<ul><li><a href="Backdoor_(computing)" title="Backdoor (computing)">Backdoor (computing)</a></li>

<li><a href="Cyberwarfare" title="Cyberwarfare">Cyberwarfare</a></li>

<li><a href="Internet_security" title="Internet security">Internet security</a></li>

<li><a href="Network_security" title="Network security">Network security</a></li>

<li><a href="China_Chopper" title="China Chopper">China Chopper</a></li>

<li><a href="Privacy" title="Privacy">Privacy</a></li>

<li><a href="Web-based_SSH" title="Web-based SSH">Web-based SSH</a></li></ul>

<div class="mw-heading mw-heading2"><h2 id="References">References</h2></div>

/* start https://en.wikipedia.org/ */

.mw-parser-output .reflist{margin-bottom:0.5em;list-style-type:decimal}@media screen{.mw-parser-output .reflist{font-size:90%}}.mw-parser-output .reflist .references{font-size:100%;margin-bottom:0;list-style-type:inherit}.mw-parser-output .reflist-columns-2{column-width:30em}.mw-parser-output .reflist-columns-3{column-width:25em}.mw-parser-output .reflist-columns{margin-top:0.3em}.mw-parser-output .reflist-columns ol{margin-top:0}.mw-parser-output .reflist-columns li{page-break-inside:avoid;break-inside:avoid-column}.mw-parser-output .reflist-upper-alpha{list-style-type:upper-alpha}.mw-parser-output .reflist-upper-roman{list-style-type:upper-roman}.mw-parser-output .reflist-lower-alpha{list-style-type:lower-alpha}.mw-parser-output .reflist-lower-greek{list-style-type:lower-greek}.mw-parser-output .reflist-lower-roman{list-style-type:lower-roman}

/* end https://en.wikipedia.org/ */

</style><div class="reflist">

/* start https://en.wikipedia.org/ */

.mw-parser-output cite.citation{font-style:inherit;word-wrap:break-word}.mw-parser-output .citation q{quotes:"\"""\"""'""'"}.mw-parser-output .citation:target{background-color:rgba(0,127,255,0.133)}.mw-parser-output .id-lock-free.id-lock-free a{background:url("./mw/Lock-green.svg")right 0.1em center/9px no-repeat}.mw-parser-output .id-lock-limited.id-lock-limited a,.mw-parser-output .id-lock-registration.id-lock-registration a{background:url("./mw/Lock-gray-alt-2.svg")right 0.1em center/9px no-repeat}.mw-parser-output .id-lock-subscription.id-lock-subscription a{background:url("./mw/Lock-red-alt-2.svg")right 0.1em center/9px no-repeat}.mw-parser-output .cs1-ws-icon a{background:url("./mw/Wikisource-logo.svg")right 0.1em center/12px no-repeat}body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .id-lock-free a,body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .id-lock-limited a,body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .id-lock-registration a,body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .id-lock-subscription a,body:not(.skin-timeless):not(.skin-minerva) .mw-parser-output .cs1-ws-icon a{background-size:contain;padding:0 1em 0 0}.mw-parser-output .cs1-code{color:inherit;background:inherit;border:none;padding:inherit}.mw-parser-output .cs1-hidden-error{display:none;color:var(--color-error,#d33)}.mw-parser-output .cs1-visible-error{color:var(--color-error,#d33)}.mw-parser-output .cs1-maint{display:none;color:#085;margin-left:0.3em}.mw-parser-output .cs1-kern-left{padding-left:0.2em}.mw-parser-output .cs1-kern-right{padding-right:0.2em}.mw-parser-output .citation .mw-selflink{font-weight:inherit}@media screen{.mw-parser-output .cs1-format{font-size:95%}html.skin-theme-clientpref-night .mw-parser-output .cs1-maint{color:#18911f}}@media screen and (prefers-color-scheme:dark){html.skin-theme-clientpref-os .mw-parser-output .cs1-maint{color:#18911f}}

/* end https://en.wikipedia.org/ */

</style><cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://searchsecurity.techtarget.com/answer/How-can-web-shells-be-used-to-exploit-security-tools-and-servers">"How can web shells be used to exploit security tools and servers?"</a>. SearchSecurity. <a rel="nofollow" class="external text" href="https://web.archive.org/web/20190328065900/https://searchsecurity.techtarget.com/answer/How-can-web-shells-be-used-to-exploit-security-tools-and-servers">Archived</a> from the original on 2019-03-28. Retrieved 2018-12-21.</cite>

</li>

<li id="cite_note-us-cert.gov-2">^ <a href="#cite_ref-us-cert.gov_2-0">a</a> <a href="#cite_ref-us-cert.gov_2-1">b</a> <a href="#cite_ref-us-cert.gov_2-2">c</a> <a href="#cite_ref-us-cert.gov_2-3">d</a> <a href="#cite_ref-us-cert.gov_2-4">e</a> <a href="#cite_ref-us-cert.gov_2-5">f</a> <a href="#cite_ref-us-cert.gov_2-6">g</a> <a href="#cite_ref-us-cert.gov_2-7">h</a> <a href="#cite_ref-us-cert.gov_2-8">i</a> <a href="#cite_ref-us-cert.gov_2-9">j</a> <a href="#cite_ref-us-cert.gov_2-10">k</a> <a href="#cite_ref-us-cert.gov_2-11">l</a> <a href="#cite_ref-us-cert.gov_2-12">m</a> <a href="#cite_ref-us-cert.gov_2-13">n</a> <a href="#cite_ref-us-cert.gov_2-14">o</a> <a href="#cite_ref-us-cert.gov_2-15">p</a> <a href="#cite_ref-us-cert.gov_2-16">q</a> <a href="#cite_ref-us-cert.gov_2-17">r</a> <a href="#cite_ref-us-cert.gov_2-18">s</a> <a href="#cite_ref-us-cert.gov_2-19">t</a> <a href="#cite_ref-us-cert.gov_2-20">u</a> <a href="#cite_ref-us-cert.gov_2-21">v</a> <a href="#cite_ref-us-cert.gov_2-22">w</a> <a href="#cite_ref-us-cert.gov_2-23">x</a> <a href="#cite_ref-us-cert.gov_2-24">y</a> <cite id="CITEREFUS_Department_of_Homeland_Security2017" class="citation web cs1">US Department of Homeland Security (9 August 2017). <a rel="nofollow" class="external text" href="https://www.us-cert.gov/ncas/alerts/TA15-314A">"Web Shells – Threat Awareness and Guidance"</a>. www.us-cert.gov. <a rel="nofollow" class="external text" href="https://web.archive.org/web/20190113062745/https://www.us-cert.gov/ncas/alerts/TA15-314A">Archived</a> from the original on 13 January 2019. Retrieved 20 December 2018.</cite> This article incorporates text from this source, which is in the <a href="Public_domain" title="Public domain">public domain</a>.

</li>

<li id="cite_note-auto-3">^ <a href="#cite_ref-auto_3-0">a</a> <a href="#cite_ref-auto_3-1">b</a> <a href="#cite_ref-auto_3-2">c</a> <a href="#cite_ref-auto_3-3">d</a> <cite id="CITEREFadmin2017" class="citation web cs1">admin (3 August 2017). <a rel="nofollow" class="external text" href="https://malware.expert/general/what-is-a-web-shell/">"What is a Web shell?"</a>. malware.expert. <a rel="nofollow" class="external text" href="https://web.archive.org/web/20190113003907/https://malware.expert/general/what-is-a-web-shell/">Archived</a> from the original on 13 January 2019. Retrieved 20 December 2018.</cite>

</li>

<li id="cite_note-us-cert.gov1-4">^ <a href="#cite_ref-us-cert.gov1_4-0">a</a> <a href="#cite_ref-us-cert.gov1_4-1">b</a> <a href="#cite_ref-us-cert.gov1_4-2">c</a> <cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://www.us-cert.gov/ncas/alerts/TA18-074A">"Russian Government Cyber Activity Targeting Energy and Other Critical Infrastructure Sectors – US-CERT"</a>. www.us-cert.gov. 16 March 2018. <a rel="nofollow" class="external text" href="https://web.archive.org/web/20181220172706/https://www.us-cert.gov/ncas/alerts/TA18-074A">Archived</a> from the original on 20 December 2018. Retrieved 20 December 2018.</cite>

</li>

<li id="cite_note-5"><a href="#cite_ref-5">^</a> <cite id="CITEREFco-organizerSupportAficionadoKitesurfer2017" class="citation web cs1">co-organizer, Makis MourelatosWordPress Security Engineer at FixMyWPWC Athens 2016; Support, W. P.; Aficionado, Security; Kitesurfer, Wannabe (16 October 2017). <a rel="nofollow" class="external text" href="https://fixmywp.com/security/what-are-web-shell-backdoors.php">"The Definitive Guide about Backdoor Attacks - What are WebShell BackDoors"</a>. fixmywp.com. <a rel="nofollow" class="external text" href="https://web.archive.org/web/20190113003929/https://fixmywp.com/security/what-are-web-shell-backdoors.php">Archived</a> from the original on 13 January 2019. Retrieved 20 December 2018.</cite><code class="cs1-code">{{cite web}}</code>: CS1 maint: numeric names: authors list (link)

</li>

<li id="cite_note-6"><a href="#cite_ref-6">^</a> <cite id="CITEREFHannousseYahiouche2021" class="citation journal cs1">Hannousse, Abdelhakim; Yahiouche, Salima (2021-09-01). <a rel="nofollow" class="external text" href="https://www.sciencedirect.com/science/article/pii/S0167404821001905">"Handling webshell attacks: A systematic mapping and survey"</a>. Computers & Security. 108: 102366. <a href="Doi_(identifier)" class="mw-redirect" title="Doi (identifier)">doi</a>:<a rel="nofollow" class="external text" href="https://doi.org/10.1016%2Fj.cose.2021.102366">10.1016/j.cose.2021.102366</a>. <a href="ISSN_(identifier)" class="mw-redirect" title="ISSN (identifier)">ISSN</a> <a rel="nofollow" class="external text" href="https://search.worldcat.org/issn/0167-4048">0167-4048</a>.</cite>

</li>

<li id="cite_note-7"><a href="#cite_ref-7">^</a> <cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://securityintelligence.com/got-wordpress-php-c99-webshell-attacks-increasing/">"Got WordPress? PHP C99 Webshell Attacks Increasing"</a>. 14 April 2016. <a rel="nofollow" class="external text" href="https://web.archive.org/web/20181229190535/https://securityintelligence.com/got-wordpress-php-c99-webshell-attacks-increasing/">Archived</a> from the original on 29 December 2018. Retrieved 21 December 2018.</cite>

</li>

<li id="cite_note-techcrunch.com-8">^ <a href="#cite_ref-techcrunch.com_8-0">a</a> <a href="#cite_ref-techcrunch.com_8-1">b</a> <cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://techcrunch.com/2018/12/10/equifax-breach-preventable-house-oversight-report/">"Equifax breach was 'entirely preventable' had it used basic security measures, says House report"</a>. 10 December 2018. <a rel="nofollow" class="external text" href="https://web.archive.org/web/20181220232937/https://techcrunch.com/2018/12/10/equifax-breach-preventable-house-oversight-report/">Archived</a> from the original on 20 December 2018. Retrieved 21 December 2018.</cite>

</li>

<li id="cite_note-fireeye.com-9">^ <a href="#cite_ref-fireeye.com_9-0">a</a> <a href="#cite_ref-fireeye.com_9-1">b</a> <a href="#cite_ref-fireeye.com_9-2">c</a> <cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://www.fireeye.com/blog/threat-research/2013/08/breaking-down-the-china-chopper-web-shell-part-i.html">"Breaking Down the China Chopper Web Shell - Part I « Breaking Down the China Chopper Web Shell - Part I"</a>. FireEye. <a rel="nofollow" class="external text" href="https://web.archive.org/web/20190113182308/https://www.fireeye.com/blog/threat-research/2013/08/breaking-down-the-china-chopper-web-shell-part-i.html">Archived</a> from the original on 13 January 2019. Retrieved 20 December 2018.</cite>

</li>

<li id="cite_note-10"><a href="#cite_ref-10">^</a> <cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://ws680.nist.gov/publication/get_pdf.cfm?pub_id=901146">"Intrusion Detection and Prevention Systems"</a>. <a rel="nofollow" class="external text" href="https://web.archive.org/web/20190113003930/https://ws680.nist.gov/publication/get_pdf.cfm?pub_id=901146">Archived</a> from the original on 2019-01-13. Retrieved 2018-12-22.</cite>

</li>

<li id="cite_note-11"><a href="#cite_ref-11">^</a> <cite id="CITEREFKasey_Cross2016" class="citation web cs1">Kasey Cross (16 June 2016). <a rel="nofollow" class="external text" href="https://www.networkworld.com/article/952495/five-signs-an-attacker-is-already-in-your-network.html">"Five signs an attacker is already in your network"</a>. Network World. <a rel="nofollow" class="external text" href="https://web.archive.org/web/20190113003925/https://www.networkworld.com/article/3085141/network-security/five-signs-an-attacker-is-already-in-your-network.html">Archived</a> from the original on 13 January 2019. Retrieved 22 December 2018.</cite>

</li>

<li id="cite_note-12"><a href="#cite_ref-12">^</a> <cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://insights.sei.cmu.edu/sei_blog/2016/09/traffic-analysis-for-network-security-two-approaches-for-going-beyond-network-flow-data.html">"Traffic Analysis for Network Security: Two Approaches for Going Beyond Network Flow Data"</a>. 15 September 2016. <a rel="nofollow" class="external text" href="https://web.archive.org/web/20161114084537/https://insights.sei.cmu.edu/sei_blog/2016/09/traffic-analysis-for-network-security-two-approaches-for-going-beyond-network-flow-data.html">Archived</a> from the original on 2016-11-14. Retrieved 2018-12-22.</cite>

</li>

<li id="cite_note-13"><a href="#cite_ref-13">^</a> <cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://www.bleepingcomputer.com/news/security/hackers-hiding-web-shell-logins-in-fake-http-error-pages/">"Hackers Hiding Web Shell Logins in Fake HTTP Error Pages"</a>. BleepingComputer. <a rel="nofollow" class="external text" href="https://web.archive.org/web/20180726011308/https://www.bleepingcomputer.com/news/security/hackers-hiding-web-shell-logins-in-fake-http-error-pages/">Archived</a> from the original on 26 July 2018. Retrieved 21 December 2018.</cite>

</li>

<li id="cite_note-14"><a href="#cite_ref-14">^</a> <cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://threatravens.com/hackers-hiding-web-shell-logins-in-fake-http-error-pages/">"Hackers Hiding Web Shell Logins in Fake HTTP Error Pages"</a>. ThreatRavens. 24 July 2018. <a rel="nofollow" class="external text" href="https://web.archive.org/web/20190113062731/https://threatravens.com/hackers-hiding-web-shell-logins-in-fake-http-error-pages/">Archived</a> from the original on 13 January 2019. Retrieved 17 February 2019.</cite>

</li>

<li id="cite_note-15"><a href="#cite_ref-15">^</a> <cite class="citation web cs1"><a rel="nofollow" class="external text" href="https://cyware.com/news/hackers-hiding-web-shell-logins-in-fake-http-error-pages-f9f1b47e">"Hackers Hiding Web Shell Logins in Fake HTTP Error Pages"</a>. cyware.com. <a rel="nofollow" class="external text" href="https://web.archive.org/web/20190113003916/https://cyware.com/news/hackers-hiding-web-shell-logins-in-fake-http-error-pages-f9f1b47e">Archived</a> from the original on 13 January 2019. Retrieved 22 December 2018.</cite>

</li>

</ol></div></div>

/* start https://en.wikipedia.org/ */

.mw-parser-output .hlist dl,.mw-parser-output .hlist ol,.mw-parser-output .hlist ul{margin:0;padding:0}.mw-parser-output .hlist dd,.mw-parser-output .hlist dt,.mw-parser-output .hlist li{margin:0;display:inline}.mw-parser-output .hlist.inline,.mw-parser-output .hlist.inline dl,.mw-parser-output .hlist.inline ol,.mw-parser-output .hlist.inline ul,.mw-parser-output .hlist dl dl,.mw-parser-output .hlist dl ol,.mw-parser-output .hlist dl ul,.mw-parser-output .hlist ol dl,.mw-parser-output .hlist ol ol,.mw-parser-output .hlist ol ul,.mw-parser-output .hlist ul dl,.mw-parser-output .hlist ul ol,.mw-parser-output .hlist ul ul{display:inline}.mw-parser-output .hlist .mw-empty-li{display:none}.mw-parser-output .hlist dt::after{content:": "}.mw-parser-output .hlist dd::after,.mw-parser-output .hlist li::after{content:" · ";font-weight:bold}.mw-parser-output .hlist dd:last-child::after,.mw-parser-output .hlist dt:last-child::after,.mw-parser-output .hlist li:last-child::after{content:none}.mw-parser-output .hlist dd dd:first-child::before,.mw-parser-output .hlist dd dt:first-child::before,.mw-parser-output .hlist dd li:first-child::before,.mw-parser-output .hlist dt dd:first-child::before,.mw-parser-output .hlist dt dt:first-child::before,.mw-parser-output .hlist dt li:first-child::before,.mw-parser-output .hlist li dd:first-child::before,.mw-parser-output .hlist li dt:first-child::before,.mw-parser-output .hlist li li:first-child::before{content:" (";font-weight:normal}.mw-parser-output .hlist dd dd:last-child::after,.mw-parser-output .hlist dd dt:last-child::after,.mw-parser-output .hlist dd li:last-child::after,.mw-parser-output .hlist dt dd:last-child::after,.mw-parser-output .hlist dt dt:last-child::after,.mw-parser-output .hlist dt li:last-child::after,.mw-parser-output .hlist li dd:last-child::after,.mw-parser-output .hlist li dt:last-child::after,.mw-parser-output .hlist li li:last-child::after{content:")";font-weight:normal}.mw-parser-output .hlist ol{counter-reset:listitem}.mw-parser-output .hlist ol>li{counter-increment:listitem}.mw-parser-output .hlist ol>li::before{content:" "counter(listitem)"\a0 "}.mw-parser-output .hlist dd ol>li:first-child::before,.mw-parser-output .hlist dt ol>li:first-child::before,.mw-parser-output .hlist li ol>li:first-child::before{content:" ("counter(listitem)"\a0 "}

/* end https://en.wikipedia.org/ */

</style><style data-mw-deduplicate="TemplateStyles:r1236075235">

/* start https://en.wikipedia.org/ */

.mw-parser-output .navbox{box-sizing:border-box;border:1px solid #a2a9b1;width:100%;clear:both;font-size:88%;text-align:center;padding:1px;margin:1em auto 0}.mw-parser-output .navbox .navbox{margin-top:0}.mw-parser-output .navbox+.navbox,.mw-parser-output .navbox+.navbox-styles+.navbox{margin-top:-1px}.mw-parser-output .navbox-inner,.mw-parser-output .navbox-subgroup{width:100%}.mw-parser-output .navbox-group,.mw-parser-output .navbox-title,.mw-parser-output .navbox-abovebelow{padding:0.25em 1em;line-height:1.5em;text-align:center}.mw-parser-output .navbox-group{white-space:nowrap;text-align:right}.mw-parser-output .navbox,.mw-parser-output .navbox-subgroup{background-color:#fdfdfd}.mw-parser-output .navbox-list{line-height:1.5em;border-color:#fdfdfd}.mw-parser-output .navbox-list-with-group{text-align:left;border-left-width:2px;border-left-style:solid}.mw-parser-output tr+tr>.navbox-abovebelow,.mw-parser-output tr+tr>.navbox-group,.mw-parser-output tr+tr>.navbox-image,.mw-parser-output tr+tr>.navbox-list{border-top:2px solid #fdfdfd}.mw-parser-output .navbox-title{background-color:#ccf}.mw-parser-output .navbox-abovebelow,.mw-parser-output .navbox-group,.mw-parser-output .navbox-subgroup .navbox-title{background-color:#ddf}.mw-parser-output .navbox-subgroup .navbox-group,.mw-parser-output .navbox-subgroup .navbox-abovebelow{background-color:#e6e6ff}.mw-parser-output .navbox-even{background-color:#f7f7f7}.mw-parser-output .navbox-odd{background-color:transparent}.mw-parser-output .navbox .hlist td dl,.mw-parser-output .navbox .hlist td ol,.mw-parser-output .navbox .hlist td ul,.mw-parser-output .navbox td.hlist dl,.mw-parser-output .navbox td.hlist ol,.mw-parser-output .navbox td.hlist ul{padding:0.125em 0}.mw-parser-output .navbox .navbar{display:block;font-size:100%}.mw-parser-output .navbox-title .navbar{float:left;text-align:left;margin-right:0.5em}body.skin--responsive .mw-parser-output .navbox-image img{max-width:none!important}@media print{body.ns-0 .mw-parser-output .navbox{display:none!important}}

/* end https://en.wikipedia.org/ */

</style></div><div role="navigation" class="navbox" aria-labelledby="Information_security92" style="padding:3px"><table class="nowraplinks mw-collapsible autocollapse navbox-inner" style="border-spacing:0;background:transparent;color:inherit"><tbody><tr><th scope="col" class="navbox-title" colspan="3"><style data-mw-deduplicate="TemplateStyles:r1239400231">

/* start https://en.wikipedia.org/ */

.mw-parser-output .navbar{display:inline;font-size:88%;font-weight:normal}.mw-parser-output .navbar-collapse{float:left;text-align:left}.mw-parser-output .navbar-boxtext{word-spacing:0}.mw-parser-output .navbar ul{display:inline-block;white-space:nowrap;line-height:inherit}.mw-parser-output .navbar-brackets::before{margin-right:-0.125em;content:"[ "}.mw-parser-output .navbar-brackets::after{margin-left:-0.125em;content:" ]"}.mw-parser-output .navbar li{word-spacing:-0.125em}.mw-parser-output .navbar a>span,.mw-parser-output .navbar a>abbr{text-decoration:inherit}.mw-parser-output .navbar-mini abbr{font-variant:small-caps;border-bottom:none;text-decoration:none;cursor:inherit}.mw-parser-output .navbar-ct-full{font-size:114%;margin:0 7em}.mw-parser-output .navbar-ct-mini{font-size:114%;margin:0 4em}html.skin-theme-clientpref-night .mw-parser-output .navbar li a abbr{color:var(--color-base)!important}@media(prefers-color-scheme:dark){html.skin-theme-clientpref-os .mw-parser-output .navbar li a abbr{color:var(--color-base)!important}}@media print{.mw-parser-output .navbar{display:none!important}}

/* end https://en.wikipedia.org/ */

</style><div id="Information_security92" style="font-size:114%;margin:0 4em"><a href="Information_security" title="Information security">Information security</a></div></th></tr><tr><th scope="row" class="navbox-group" style="width:1%"><a href="Threat_(computer)" class="mw-redirect" title="Threat (computer)">Threats</a></th><td class="navbox-list-with-group navbox-list navbox-odd hlist" style="width:100%;padding:0"><div style="padding:0 0.25em">

<ul><li><a href="Adware" title="Adware">Adware</a></li>

<li><a href="Advanced_persistent_threat" title="Advanced persistent threat">Advanced persistent threat</a></li>

<li><a href="Arbitrary_code_execution" title="Arbitrary code execution">Arbitrary code execution</a></li>

<li><a href="Backdoor_(computing)" title="Backdoor (computing)">Backdoors</a></li>

<li>Bombs

<li><a href="Logic_bomb" title="Logic bomb">Logic</a></li>

<li><a href="Hardware_backdoor" title="Hardware backdoor">Hardware backdoors</a></li>

<li><a href="Code_injection" title="Code injection">Code injection</a></li>

<li><a href="Crimeware" title="Crimeware">Crimeware</a></li>

<li><a href="Cross-site_scripting" title="Cross-site scripting">Cross-site scripting</a></li>

<li><a href="Cross-site_leaks" title="Cross-site leaks">Cross-site leaks</a></li>

<li><a href="DOM_clobbering" title="DOM clobbering">DOM clobbering</a></li>

<li><a href="History_sniffing" title="History sniffing">History sniffing</a></li>

<li><a href="Cryptojacking" title="Cryptojacking">Cryptojacking</a></li>

<li><a href="Botnet" title="Botnet">Botnets</a></li>

<li><a href="Data_breach" title="Data breach">Data breach</a></li>

<li><a href="Drive-by_download" title="Drive-by download">Drive-by download</a></li>

<li><a href="Browser_Helper_Object" title="Browser Helper Object">Browser Helper Objects</a></li>

<li><a href="Computer_virus" title="Computer virus">Viruses</a></li>

<li><a href="Data_scraping" title="Data scraping">Data scraping</a></li>

<li><a href="Denial-of-service_attack" title="Denial-of-service attack">Denial-of-service attack</a></li>

<li><a href="Eavesdropping" title="Eavesdropping">Eavesdropping</a></li>

<li><a href="Email_fraud" title="Email fraud">Email fraud</a></li>

<li><a href="Email_spoofing" title="Email spoofing">Email spoofing</a></li>

<li><a href="Exploit_(computer_security)" title="Exploit (computer security)">Exploits</a></li>

<li><a href="Dialer#Fraudulent_dialer" title="Dialer">Fraudulent dialers</a></li>

<li><a href="Hacktivism" title="Hacktivism">Hacktivism</a></li>

<li><a href="Infostealer" title="Infostealer">Infostealer</a></li>

<li><a href="Insecure_direct_object_reference" title="Insecure direct object reference">Insecure direct object reference</a></li>

<li><a href="Keystroke_logging" title="Keystroke logging">Keystroke loggers</a></li>

<li><a href="Malware" title="Malware">Malware</a></li>

<li><a href="Payload_(computing)" title="Payload (computing)">Payload</a></li>

<li><a href="Phishing" title="Phishing">Phishing</a>

<ul><li><a href="Voice_phishing" title="Voice phishing">Voice</a></li></ul></li>

<li><a href="Polymorphic_engine" title="Polymorphic engine">Polymorphic engine</a></li>

<li><a href="Privilege_escalation" title="Privilege escalation">Privilege escalation</a></li>

<li><a href="Ransomware" title="Ransomware">Ransomware</a></li>

<li><a href="Rootkit" title="Rootkit">Rootkits</a></li>

<li><a href="Scareware" title="Scareware">Scareware</a></li>

<li><a href="Shellcode" title="Shellcode">Shellcode</a></li>

<li><a href="Spamming" title="Spamming">Spamming</a></li>

<li><a href="Social_engineering_(security)" title="Social engineering (security)">Social engineering</a></li>

<li><a href="Spyware" title="Spyware">Spyware</a></li>

<li><a href="Software_bug" title="Software bug">Software bugs</a></li>

<li><a href="Trojan_horse_(computing)" title="Trojan horse (computing)">Trojan horses</a></li>

<li><a href="Hardware_Trojan" title="Hardware Trojan">Hardware Trojans</a></li>

<li><a href="Remote_access_trojan" class="mw-redirect" title="Remote access trojan">Remote access trojans</a></li>

<li><a href="Vulnerability_(computer_security)" title="Vulnerability (computer security)">Vulnerability</a></li>

<li><a href="Wiper_(malware)" title="Wiper (malware)">Wiper</a></li>

<li><a href="Computer_worm" title="Computer worm">Worms</a></li>

<li><a href="SQL_injection" title="SQL injection">SQL injection</a></li>

<li><a href="Rogue_security_software" title="Rogue security software">Rogue security software</a></li>

<li><a href="Zombie_(computing)" title="Zombie (computing)">Zombie</a></li></ul>

</div></td><td class="noviewer navbox-image" rowspan="3" style="width:1px;padding:0 0 0 2px"><div></div></td></tr><tr><th scope="row" class="navbox-group" style="width:1%">Defenses</th><td class="navbox-list-with-group navbox-list navbox-even hlist" style="width:100%;padding:0"><div style="padding:0 0.25em">

<ul><li><a href="Application_security" title="Application security">Application security</a>

<ul><li><a href="Secure_coding" title="Secure coding">Secure coding</a></li>

<li>Secure by default</li>

<li><a href="Secure_by_design" title="Secure by design">Secure by design</a>

<ul><li><a href="Misuse_case" title="Misuse case">Misuse case</a></li></ul></li></ul></li>

<li><a href="Computer_access_control" title="Computer access control">Computer access control</a>

<ul><li><a href="Authentication" title="Authentication">Authentication</a>

<ul><li><a href="Multi-factor_authentication" title="Multi-factor authentication">Multi-factor authentication</a></li></ul></li>

<li><a href="Authorization" title="Authorization">Authorization</a></li></ul></li>

<li><a href="Computer_security_software" title="Computer security software">Computer security software</a>

<ul><li><a href="Antivirus_software" title="Antivirus software">Antivirus software</a></li>

<li><a href="Security-focused_operating_system" title="Security-focused operating system">Security-focused operating system</a></li></ul></li>

<li><a href="Data-centric_security" title="Data-centric security">Data-centric security</a></li>

<li><a href="Obfuscation_(software)" title="Obfuscation (software)">Software obfuscation</a></li>

<li><a href="Data_masking" title="Data masking">Data masking</a></li>

<li><a href="Encryption" title="Encryption">Encryption</a></li>

<li><a href="Firewall_(computing)" title="Firewall (computing)">Firewall</a></li>

<li><a href="Intrusion_detection_system" title="Intrusion detection system">Intrusion detection system</a>

<ul><li><a href="Host-based_intrusion_detection_system" title="Host-based intrusion detection system">Host-based intrusion detection system</a> (HIDS)</li>

<li><a href="Anomaly_detection" title="Anomaly detection">Anomaly detection</a></li></ul></li>

<li><a href="Information_security_management" title="Information security management">Information security management</a>

<ul><li><a href="Information_risk_management" class="mw-redirect" title="Information risk management">Information risk management</a></li>

<li><a href="Security_information_and_event_management" title="Security information and event management">Security information and event management</a> (SIEM)</li></ul></li>

<li><a href="Runtime_application_self-protection" title="Runtime application self-protection">Runtime application self-protection</a></li>

<li><a href="Site_isolation" title="Site isolation">Site isolation</a></li></ul>

</div></td></tr><tr><th scope="row" class="navbox-group" style="width:1%">Related security topics</th><td class="navbox-list-with-group navbox-list navbox-odd hlist" style="width:100%;padding:0"><div style="padding:0 0.25em">

<ul><li><a href="Computer_security" title="Computer security">Computer security</a></li>

<li><a href="Automotive_security" title="Automotive security">Automotive security</a></li>

<li><a href="Cybercrime" title="Cybercrime">Cybercrime</a>

<ul><li><a href="Cybersex_trafficking" title="Cybersex trafficking">Cybersex trafficking</a></li>

<li><a href="Computer_fraud" title="Computer fraud">Computer fraud</a></li></ul></li>

<li><a href="Cybergeddon" title="Cybergeddon">Cybergeddon</a></li>

<li><a href="Cyberterrorism" title="Cyberterrorism">Cyberterrorism</a></li>

<li><a href="Cyberwarfare" title="Cyberwarfare">Cyberwarfare</a></li>

<li><a href="Electronic_warfare" title="Electronic warfare">Electronic warfare</a></li>

<li><a href="Information_warfare" title="Information warfare">Information warfare</a></li>

<li><a href="Internet_security" title="Internet security">Internet security</a></li>

<li><a href="Mobile_security" title="Mobile security">Mobile security</a></li>

<li><a href="Network_security" title="Network security">Network security</a></li>

<li><a href="Copy_protection" title="Copy protection">Copy protection</a></li>

<li><a href="Digital_rights_management" title="Digital rights management">Digital rights management</a></li></ul>

</div></td></tr></tbody></table></div>

<div class="navbox-styles"></div><div role="navigation" class="navbox" aria-labelledby="Malware_topics109" style="padding:3px"><table class="nowraplinks mw-collapsible autocollapse navbox-inner" style="border-spacing:0;background:transparent;color:inherit"><tbody><tr><th scope="col" class="navbox-title" colspan="2"><div id="Malware_topics109" style="font-size:114%;margin:0 4em"><a href="Malware" title="Malware">Malware</a> topics</div></th></tr><tr><th scope="row" class="navbox-group" style="width:1%">Infectious malware</th><td class="navbox-list-with-group navbox-list navbox-odd hlist" style="width:100%;padding:0"><div style="padding:0 0.25em">

<ul><li><a href="Comparison_of_computer_viruses" title="Comparison of computer viruses">Comparison of computer viruses</a></li>

<li><a href="Computer_virus" title="Computer virus">Computer virus</a></li>

<li><a href="Computer_worm" title="Computer worm">Computer worm</a></li>

<li><a href="List_of_computer_worms" title="List of computer worms">List of computer worms</a></li>

<li><a href="Timeline_of_computer_viruses_and_worms" title="Timeline of computer viruses and worms">Timeline of computer viruses and worms</a></li></ul>

</div></td></tr><tr><th scope="row" class="navbox-group" style="width:1%">Concealment</th><td class="navbox-list-with-group navbox-list navbox-even hlist" style="width:100%;padding:0"><div style="padding:0 0.25em">

<ul><li><a href="Backdoor_(computing)" title="Backdoor (computing)">Backdoor</a></li>

<li><a href="Clickjacking" title="Clickjacking">Clickjacking</a></li>

<li><a href="Man-in-the-browser" title="Man-in-the-browser">Man-in-the-browser</a></li>

<li><a href="Man-in-the-middle_attack" title="Man-in-the-middle attack">Man-in-the-middle</a></li>

<li><a href="Rootkit" title="Rootkit">Rootkit</a></li>

<li><a href="Trojan_horse_(computing)" title="Trojan horse (computing)">Trojan horse</a></li>

<li><a href="Zombie_(computing)" title="Zombie (computing)">Zombie computer</a></li></ul>

</div></td></tr><tr><th scope="row" class="navbox-group" style="width:1%">Malware for profit</th><td class="navbox-list-with-group navbox-list navbox-odd hlist" style="width:100%;padding:0"><div style="padding:0 0.25em">

<ul><li><a href="Adware" title="Adware">Adware</a></li>

<li><a href="Botnet" title="Botnet">Botnet</a></li>

<li><a href="Crimeware" title="Crimeware">Crimeware</a></li>

<li><a href="Fleeceware" title="Fleeceware">Fleeceware</a></li>

<li><a href="Form_grabbing" title="Form grabbing">Form grabbing</a></li>

<li><a href="Dialer#Fraudulent_dialer" title="Dialer">Fraudulent dialer</a></li>

<li><a href="Infostealer" title="Infostealer">Infostealer</a></li>

<li><a href="Keystroke_logging" title="Keystroke logging">Keystroke logging</a></li>

<li><a href="Internet_bot#Malicious_purposes" title="Internet bot">Malbot</a></li>

<li><a href="Privacy-invasive_software" class="mw-redirect" title="Privacy-invasive software">Privacy-invasive software</a></li>

<li><a href="Ransomware" title="Ransomware">Ransomware</a></li>

<li><a href="Rogue_security_software" title="Rogue security software">Rogue security software</a></li>

<li><a href="Scareware" title="Scareware">Scareware</a></li>

<li><a href="Spyware" title="Spyware">Spyware</a></li>

<li><a href="Web_threat" title="Web threat">Web threats</a></li></ul>

</div></td></tr><tr><th scope="row" class="navbox-group" style="width:1%">By operating system</th><td class="navbox-list-with-group navbox-list navbox-even hlist" style="width:100%;padding:0"><div style="padding:0 0.25em">

<ul><li>Android malware</li>

<li>Classic Mac OS viruses</li>

<li>iOS malware</li>

<li><a href="Linux_malware" title="Linux malware">Linux malware</a></li>

<li>MacOS malware</li>

<li><a href="Macro_virus" title="Macro virus">Macro virus</a></li>

<li><a href="Mobile_malware" title="Mobile malware">Mobile malware</a></li>

<li><a href="Palm_OS_viruses" title="Palm OS viruses">Palm OS viruses</a></li>

<li><a href="HyperCard_viruses" class="mw-redirect" title="HyperCard viruses">HyperCard viruses</a></li></ul>

</div></td></tr><tr><th scope="row" class="navbox-group" style="width:1%">Protection</th><td class="navbox-list-with-group navbox-list navbox-odd hlist" style="width:100%;padding:0"><div style="padding:0 0.25em">

<ul><li><a href="Anti-keylogger" title="Anti-keylogger">Anti-keylogger</a></li>

<li><a href="Antivirus_software" title="Antivirus software">Antivirus software</a></li>

<li><a href="Browser_security" title="Browser security">Browser security</a></li>

<li><a href="Data_loss_prevention_software" title="Data loss prevention software">Data loss prevention software</a></li>

<li><a href="Defensive_computing" title="Defensive computing">Defensive computing</a></li>

<li><a href="Firewall_(computing)" title="Firewall (computing)">Firewall</a></li>

<li><a href="Internet_security" title="Internet security">Internet security</a></li>

<li><a href="Intrusion_detection_system" title="Intrusion detection system">Intrusion detection system</a></li>

<li><a href="Mobile_security" title="Mobile security">Mobile security</a></li>

<li><a href="Network_security" title="Network security">Network security</a></li></ul>

</div></td></tr><tr><th scope="row" class="navbox-group" style="width:1%">Countermeasures</th><td class="navbox-list-with-group navbox-list navbox-even hlist" style="width:100%;padding:0"><div style="padding:0 0.25em">

<ul><li><a href="Computer_and_network_surveillance" title="Computer and network surveillance">Computer and network surveillance</a></li>

<li><a href="Honeypot_(computing)" title="Honeypot (computing)">Honeypot</a></li>

<li><a href="Operation%3A_Bot_Roast" title="Operation: Bot Roast">Operation: Bot Roast</a></li></ul>

</div></td></tr></tbody></table></div></div><div><div class="zim-footer">

This article is issued from <a class="external text" title="Last edited on 2025-05-23" href="https://en.wikipedia.org/wiki/?title=Web_shell&oldid=1291870091">Wikipedia</a>. The text is available under <a class="external text" href="https://creativecommons.org/licenses/by-sa/4.0/deed.en">Creative Commons Attribution-Share Alike 4.0</a> unless otherwise noted. Additional terms may apply for the media files.

</div>

</div></div>

</div>

</main>

</div>

</body></html>