<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# Analyzing Webshell Artifacts — API Reference

## YARA — Webshell Scanning

```bash
# Scan web root with webshell rule set
yara -r webshell_rules.yar /var/www/html/

# Scan with Neo23x0 signature-base
git clone https://github.com/Neo23x0/signature-base.git
yara -r signature-base/yara/gen_webshells.yar /var/www/html/
```

## NeoPI — Entropy-Based Detection

```bash
git clone https://github.com/Neohapsis/NeoPI.git
cd NeoPI

# Full analysis (entropy + longest word + index of coincidence)
python3 neopi.py -a /var/www/html/ -e php
python3 neopi.py -a /var/www/html/ -e asp
python3 neopi.py -a /var/www/html/ -e jsp
```

## PHP Deobfuscation

### Safe eval replacement

```bash
# Replace eval with echo to reveal payload
sed 's/eval(/echo(/g' shell.php | php

# Decode base64 layers iteratively
php -r '$d = file_get_contents("shell.php");
while(preg_match("/base64_decode\([\"'\'']([^\"'\'']+)/", $d, $m)) {
    $d = base64_decode($m[1]);
    echo $d . "\n---\n";
}'
```

## Access Log Analysis

### Apache

```bash
# POST requests to unusual paths
grep "POST" /var/log/apache2/access.log | grep -iE "\.(php|asp|jsp)" | \
    awk '{print $7}' | sort | uniq -c | sort -rn | head -20

# Large response sizes (data exfiltration indicator)
awk '$10 > 100000 {print $1, $7, $10}' /var/log/apache2/access.log
```

### IIS

```powershell
# Parse IIS logs for webshell access
Get-Content C:\inetpub\logs\LogFiles\W3SVC1\*.log |
    Where-Object { $_ -match "POST" -and $_ -match "\.(asp|aspx|ashx)" } |
    Select-Object -First 50
```

## File Integrity

```bash
# Baseline web root hashes
find /var/www/html/ -type f \( -name "*.php" -o -name "*.asp*" -o -name "*.jsp" \) \
    -exec sha256sum {} \; > baseline_hashes.txt

# Compare against baseline
sha256sum -c baseline_hashes.txt 2>&1 | grep -v "OK$"
```
