# What is a web shell?

A web shell is a small malicious script placed on a web server, usually through a vulnerability in an internet-facing application, that lets an attacker run commands on the server through ordinary web requests. It is a common way to keep access to exploited systems such as file-transfer servers, mail servers or content management systems, and it blends into normal web traffic. Signs are new or changed script files in web directories, web server processes starting command shells, and the server itself suddenly connecting out to the internet or to internal machines it never talked to before. Patch internet-facing applications quickly, monitor web directories for changes and limit what the web server can reach. The file is visible on the host; NetSenX sees the network behaviour that follows, such as a public-facing server scanning the internal network or sending unusual volumes out, on every plan.

FAQ: [Attack techniques explained](https://netsenx.com/en/faq/attacks) · https://netsenx.com/en/faq/what-is-a-web-shell

## Read next

- https://netsenx.com/en/detect-lateral-movement-c2-beaconing
- https://netsenx.com/en/is-someone-inside-your-network

## Related questions

- [What is protocol tunnelling?](https://netsenx.com/en/faq/what-is-protocol-tunnelling)
- [Why do attackers use legitimate remote-access tools?](https://netsenx.com/en/faq/why-do-attackers-use-legitimate-remote-access-tools)
- [What is wiper malware?](https://netsenx.com/en/faq/what-is-wiper-malware)
- [What is cryptojacking, and can we see it on the network?](https://netsenx.com/en/faq/what-is-cryptojacking)
- [What is lateral movement in cybersecurity?](https://netsenx.com/en/faq/what-is-lateral-movement-in-cybersecurity)