webshellDc v0.1

webshell通常是指利用asp、jsp、php、py、pl脚本语言编写，对web服务器进行管理的工具，也叫webadmin。webshell可以用来上传下载文件，查看数据库，系统命令调用，因此常被黑客利用并对服务器进行一系列入侵操作，具备威胁大、隐蔽性强等特点。

本项目分别收集了160个Github项目的webshell黑样本和大量个开源php、jsp、asp、java项目作为白样本，去重后黑样本2944个，白样本11945个，采用CountVectorizer和TfidfTransformer对n-gram后的样本进行特征向量处理，分别采用多层神经网络、XGBoost、朴素贝叶斯进行训练。其中MLPClassifier模型表现较好。

使用方式

训练：
python train.py -n webshelldir(黑样本文件路径) -p normaldir(白样本文件路径) -m mlp(模型选项)

测试：
python webshellDc.py

训练环境

系统：macOS 16 GB + python 3.6.3 执行时间：134s

运行截图

白名单检测： 检测总量:11945, 检测出webshell:23, 检测出正常文件:11922 误报率：0.0019254918375889493

黑名单检测： 检测总量:2944, 检测出webshell:2925, 检测出正常文件:19 召回率：0.993546195652174

黑样本

https://github.com/tennc/webshell
https://github.com/ysrc/webshell-sample https://github.com/xl7dev/WebShell https://github.com/tdifg/WebShell https://github.com/fictivekin/webshell https://github.com/bartblaze/PHP-backdoors https://github.com/malwares/WebShell https://github.com/xypiie/WebShell https://github.com/testsecer/WebShell https://github.com/nbs-system/php-malware-finder https://github.com/BlackArch/webshells https://github.com/tanjiti/webshellSample https://github.com/dotcppfile/DAws https://github.com/theralfbrown/webshell https://github.com/gokyle/webshell https://github.com/sunnyelf/cheetah https://github.com/JohnTroony/php-webshells https://github.com/evilcos/python-webshell https://github.com/lhlsec/webshell https://github.com/shewey/webshell https://github.com/boy-hack/WebshellManager https://github.com/liulongfei/web_shell_bopo https://github.com/Ni7eipr/webshell https://github.com/WangYihang/Webshell-Sniper https://github.com/pm2-hive/pm2-webshell https://github.com/samdark/yii2-webshell https://github.com/b1ueb0y/webshell https://github.com/oneoneplus/webshell https://github.com/zhaojh329/xterminal https://github.com/juanparati/Webshell https://github.com/wofeiwo/webshell-find-tools https://github.com/abcdlzy/webshell-manager https://github.com/alert0/webshellch https://github.com/needle-wang/jweevely https://github.com/tengzhangchao/PyCmd https://github.com/0x73686974/WebShell https://github.com/wonderqs/Blade https://github.com/le4f/aspexec https://github.com/jijinggang/WebShell https://github.com/matiasmenares/Shuffle https://github.com/Skycrab/PySpy https://github.com/huge818/webshell https://github.com/gb-sn/go-webshell https://github.com/BlackHole1/Fastener https://github.com/blackhalt/WebShells https://github.com/tomas1000r/webshell https://github.com/hanzhibin/Webshell https://github.com/decebel/webShell https://github.com/Aviso-hub/Webshell https://github.com/vnhacker1337/Webshell https://github.com/bittorrent3389/Webshell https://github.com/anhday22/WebShell https://github.com/buxiaomo/webshell https://github.com/z3robat/webshell https://github.com/n3oism/webshell https://github.com/uuleaf/WebShell https://github.com/onefor1/webshell https://github.com/cunlin-yu/webshell https://github.com/roytest1/webshell https://github.com/backlion/webshell https://github.com/opetrovski/webshell https://github.com/opetrovski/webshell https://github.com/gsmlg/webshell https://github.com/health901/webshell https://github.com/inof8r/WebShell https://github.com/Najones19746/webShell https://github.com/RaspiCar/WebShell https://github.com/health901/webshell https://github.com/dinamsky/WebShell https://github.com/Fay48/WebShell https://github.com/tuz358/webshell https://github.com/shajf/Webshell https://github.com/t17lab/WebShell https://github.com/blacksunwen/webshell https://github.com/webshellarchive/webshellco https://github.com/lolwaleet/Rubshell https://github.com/WhiteWinterWolf/WhiteWinterWolf-php-webshell https://github.com/goodtouch/jruby-webshell https://github.com/maestrano/webshell-server https://github.com/LuciferoO/webshell-collector https://github.com/wangeradd1/myWebShell https://github.com/0xHJK/caidao https://github.com/alintamvanz/1945shell https://github.com/Venen0/vshell https://github.com/lojikil/tinyshell https://github.com/wso-shell/PHP-SHELL-WSO https://github.com/meme-lord/PHPShellBackdoors https://github.com/Learn2Better/51mp3L-Web-Backdoor https://github.com/yuxiaokui/JBoss-Hack https://github.com/SecurityRiskAdvisors/cmd.jsp https://github.com/ddcunningham/crude-shellhunter https://github.com/stormdark/BackdoorPHP https://github.com/vduddu/Malware https://github.com/1oid/BurstPHPshell https://github.com/gokyle/urlshorten_ng https://github.com/rhelsing/trello_osx https://github.com/pfrazee/wsh-grammar https://github.com/x-o-r-r-o/PHP-Webshells-Collection https://github.com/IHA114/WebShell2 https://github.com/WangYihang/WebShellCracker https://github.com/KINGSABRI/WebShellConsole https://github.com/jujinesy/webshells.17.03.18 https://github.com/hackzsd/HandyShells https://github.com/mperlet/pomsky https://github.com/cybernoir/bns-php-shell https://github.com/XianThi/rexShell https://github.com/H4CK3RT3CH/php-webshells https://github.com/minisllc/subshell https://github.com/linuxsec/indoxploit-shell https://github.com/kuniasahi/mpshell https://github.com/datasiph0n/MyBB-Shell-Plugin https://github.com/magicming200/evil-koala-php-webshell https://github.com/0xK3v/Simple-WebShell https://github.com/djoq/docker-pm2-webshell https://github.com/SMRUCC/GCModeller.WebShell https://github.com/darknesstiller/WebShells https://github.com/devilscream/remoteshell https://github.com/0verl0ad/gorosaurus https://github.com/grCod/poly https://github.com/cryptobioz/wizhack https://github.com/amwso/docker-webshell https://github.com/William-Hunter/JSP_Webshell https://github.com/yangbaopeng/ashx_webshell https://github.com/webshellpub/awsome-webshell https://github.com/noalh8t/simple-webshell https://github.com/s3cureshell/wso-2.8-web-shell https://github.com/LiamRandall/simpleexec https://github.com/Samorodek/humhub-modules-webshell https://github.com/mwambler/webshell-xpages-ext-lib https://github.com/AVGP/Wesh https://github.com/edibledinos/weevely3-stealth https://github.com/lehins/haskell-webshell https://github.com/guglia001/php-secure-remove https://github.com/gokyle/webshell_tutorial https://github.com/azmanishak/webshell-php https://github.com/andrefernandes/docker-webshell https://github.com/codehz/node-webshell https://github.com/koolshare/merlin-webshell https://github.com/StephaneP/erl-webshell https://github.com/jjjmaracay3/webshells https://github.com/grCod/webshells https://github.com/ian4hu/bootshell https://github.com/Ghostboy-287/wso-webshell https://github.com/xiaoxiaoleo/xiao-webshell https://github.com/alexbires/webshellmanagement https://github.com/codeT/collectWebShell https://github.com/PhilCodeEx/jak3fr0z https://github.com/Ettack/WebshellCCL https://github.com/jubal-R/TinyWebShell https://github.com/CaledoniaProject/AxisInvoker https://github.com/theBrianCui/ISSS_webShell https://github.com/webshell/webshell-node-sdk https://github.com/Medicean/AS_BugScan https://github.com/3xp10it/xwebshell https://github.com/niemand-sec/RazorSyntaxWebshell https://github.com/LuciferoO/webshell-collector https://github.com/0verl0ad/HideShell https://github.com/L-codes/oneshellcrack https://github.com/ArchAssault-Project/webshells https://github.com/AndrHacK/andrshell