Skip to content
Branch: master
Go to file

Latest commit


Failed to load latest commit information.
Latest commit message
Commit time


HTSHELLS - Self contained web shells and other attacks via .htaccess files.

Attacks are named in the following fashion, module.attack.htaccess and grouped
by attack type in directories. Pick the one you need and copy it to a new file
named .htaccess, check the file to see if it needs editing before you upload it.
Web shells executes commands from the query parameter c, unless the file states

== DOS/       # Denial of service attacks
- apache.dos.htaccess
  Makes all requests return a 500 internal server error

- mod_rewrite.dos.htaccess
  Regular expression dos condition in mod_rewrite consumes a child process

== INFO/      # Information disclosure attacks
- modcheck/
  Include additional response headers to indicate which Apache modules are active
- *untested*
  Server status binding for the mod_caucho Resin java server module

  Clamav status page binding

  Server info binding for Apache

- *untested*
  Server status binding for the mod_ldap server module

  Display the mod_perl status page

  Make all php pages show source instead of executing

  Server status binding for Apache

== SHELL/       # Interactive command execution
- *untested*
  JSP based web shell

  Shell using bash under the cgi handler, Requires exec flag to be set on the htaccess file.

- *untested*
  Gives shell through php.exe via apache cgi configuration directives

  Server Side Include based web shell

  Multiple shells in one .htaccess file, one attack fits all approach

- *incomplete*

  PHP based web shell access via http://domain/path/.htaccess?c=command

- mod_php.shell2.htaccess
  Alternate method of invoking a php shell from .htaccess file

  PHP based stealth backdoor - see for tutorial




== TRAVERSAL/   # Directory traversal attacks
- mod_hitlog.traversal.htaccess
  Directory traversal attack via hitlog module tries to read /etc/passwd

- mod_layout.traversal.htaccess
  Directory traversal attack reads /etc/passwd

== ./           # Various attacks
- mod_auth_remote.phish.htaccess *untested*
  Forward basic auth credentials to server of your choice

- mod_badge.admin.htaccess
  mod_badge admin page binding

- mod_sendmail.rce.htaccess *untested*
  Executes commands configured in the .htaccess file by specifying path and arguments to "sendmail" binary

Wireghoul -
You can’t perform that action at this time.