Weevely is a stealth PHP web shell that provides a telnet-like console. It is an essential tool for web application post exploitation, and can be used as stealth backdoor or as a web shell to manage legit web accounts, even free hosted ones.
Weevely is currently included in Backtrack and Backbox and all the major Linux distributions oriented for penetration testing.
- More than 30 modules to automatize administration and post exploitation tasks:
- Execute commands and browse remote filesystem, even with PHP security restriction
- Audit common server misconfigurations
- Run SQL console pivoting on target machine
- Proxy your HTTP traffic through target
- Mount target filesystem to local mount point
- Simple file transfer from and to target
- Spawn reverse and direct TCP shells
- Bruteforce SQL accounts through target system
- Run port scans from target machine
- And so on..
- Backdoor communications are hidden in HTTP Cookies
- Communications are obfuscated to bypass NIDS signature detection
- Backdoor polymorphic PHP code is obfuscated to avoid HIDS AV detection
You can download Weevely v1.0 here:
Or read more here.
Recent in Exploits/Vulnerabilities:
- Andrew Auernheimer AKA Weev Gets 41 Months Jail Time For GET Requests
- Evernote Hacked – ALL Users Required To Reset Passwords
- Apple, Facebook & Hundreds More Hacked By 0-Day Java Exploit
- Shelling our way up
- sqlninja 0.1.0alpha – MS-SQL Injection Tool
- XSS Shell v0.3.9 – Cross Site Scripting Backdoor Tool
Most Read in Exploits/Vulnerabilities:
- Learn to use Metasploit – Tutorials, Docs & Videos - 219,183 views
- AJAX: Is your application secure enough? - 117,880 views
- eEye Launches 0-Day Exploit Tracker - 84,883 views