hunting-web-backdoors

Hunting Web Backdoors

This is not a vulnerability audit. You are looking for code an attacker already planted — a webshell, a one-line eval backdoor, a fake plugin, a malicious line appended to a legitimate file. The weakness that let them in is auditing-php-applications' job; this skill finds what they left behind.

Two things make it hard. The malicious code is deliberately hidden — obfuscated, split, or buried in a tree of thousands of legitimate files — so a naive grep misses it. And the tells (eval, base64_decode, dynamic calls) appear in plenty of benign code, so a naive grep also drowns you in false positives. The work is the discrimination.

When to Use

• A web server is suspected or confirmed compromised and you need every shell
• Cleaning a hacked WordPress, Magento, Joomla, or custom PHP site
• Vetting a downloaded plugin, theme, or codebase before deploying it
• A file contains eval, assert, or system on decoded or request-derived input
• Triaging a web root full of unfamiliar PHP for planted malice

When NOT to Use

• Finding the vulnerability that allowed the upload — use auditing-php-applications
• Deep single-sample analysis (a specific shell you want to fully reverse, its C2, its capabilities) — use analyzing-malware
• The broader incident (scoping, timeline, containment) — use responding-to-incidents; this skill is the source-tree sweep within it
• Malicious dependencies / package install scripts — use auditing-supply-chain
• Host-level persistence (cron, systemd, LD_PRELOAD) — use analyzing-linux-persistence

Never Execute to Deobfuscate

The single rule that must not bend: the obfuscated code is the payload. Do not run it, do not "just let PHP decode it," do not replace eval( with echo( and execute the file, do not paste it into an online sandbox that runs it. Deobfuscation is a static transformation:

• Decode the layers by hand or with a decode-only tool (base64_decode, gzinflate, gzuncompress, str_rot13, hex/\xNN, strrev) applied as string operations, not as executed PHP.
• If you must automate, use a de-obfuscator that decodes without executing (UnPHP's decoder, a Python reimplementation of the decode chain) — never the PHP interpreter on the sample.
• Replacing the final eval( with file_put_contents('out.php', ...) and running it is executing the payload if any prior layer has side effects. Decode statically, then read.