Webshell Signal Explorer

<?php
/* thumbnail cache — do not edit */
$k = 'ZXhhbXBsZQ==';
$p = base64_decode($k);
eval($p);

Signals

• heuristics · php.dynamic_eval +45

  Code is built at runtime and executed — eval() receives a variable, not a literal. Legitimate application code almost never needs this; loaders always do.

• heuristics +25

  Decoder immediately before the sink — base64_decode() feeds the executing call directly. The distance between decoding and execution is the tell — not the function itself.

• heuristics +20

  PHP inside an upload directory — wp-content/uploads/ receives files from the internet. A .php file there has no legitimate reason to exist, whatever it contains.

• heuristics +8

  Comment mimics platform vocabulary — “do not edit” headers are cheap camouflage against a human reviewer. On its own this proves nothing; it only raises the score once other signals fire.

<?php
$s = 'nSjXpH5NmH2Wn2E=';
$x = gzinflate(base64_decode(str_rot13($s)));
$h = "\x73\x79\x73\x74\x65\x6d";
echo strlen($x);

Signals

• heuristics +35

  Three decoders in one expression — str_rot13 → base64_decode → gzinflate is a transformation chain, not data handling. Each function is harmless; the composition is the signal.

• heuristics +24

  Hex-escaped string literal — A long \x.. sequence hides a plain identifier from anything that searches for words. PHP resolves it at parse time; a reader does not.

• heuristics · php.escape_density +12

  Unusual density of escape sequences — Measured against the rest of the file. On its own this fires on legitimate library code too — which is exactly why it never decides alone.

• heuristics +15

  File name imitates core, path does not match — The name mimics WordPress core, but no such file exists in the distribution, and its hash is not in the known-good allowlist.

<?php
$a = 'php';
$b = 'info';
$f = $a . $b;
$f();

Signals

• heuristics · php.variable_call +28

  Call target assembled at runtime — The callee never appears as a literal, so no static rule can name it. Dispatchers, plugin loaders and DI containers do this legitimately every day.

• heuristics +10

  Identifier split across concatenation — Splitting a name into fragments is a search-evasion pattern. In framework code it is often just readability.

GIF89a;
<?php echo 1; ?>

Signals

• heuristics +40

  PHP open tag with code inside a media file — A <? byte pair alone is not enough — that produced false positives on ordinary JPEGs and was fixed. An explicit tag with executable code after it is.

• heuristics +26

  Declared type and content disagree — Type detection by magic bytes only steers priority. A file whose extension, magic bytes and content tell three different stories is inspected, never skipped as “just an image”.

• heuristics +18

  Writable upload path — The file arrived where anonymous visitors can write. Combined with the tag, that answers “how did it get here” before anyone has to ask.

# .htaccess
AddType application/x-httpd-php .png
AddHandler application/x-httpd-php .ico

; .user.ini
auto_prepend_file = /home/example/public_html/wp-content/uploads/.cache.php

Signals

• heuristics +42

  Extension remapped to the PHP handler — AddType/AddHandler under a document root turns inert uploads into executables. Almost no legitimate site needs this below uploads/.

• heuristics +38

  `auto_prepend_file` set from inside a site — This is the same mechanism Shelltrap’s own upload gate uses, which is exactly why the product treats a site-level override as a finding rather than trusting it.

• heuristics +11

  Dot-file in a public directory — The prepended file is hidden from a casual ls. Persistence lives in the files nobody lists.

<?php
// wp-includes/kses.php — unmodified WordPress core
$string = str_replace( array( '&amp;', '&lt;', '&gt;' ), array( '&', '<', '>' ), $string );
$string = wp_kses_normalize_entities( $string, $context );
$string = preg_replace( '/&([^&\s;]+)(?![0-9a-z;])/', '&amp;$1', $string );

Signals

• heuristics · php.escape_density +12

  High density of escaped characters — An HTML sanitiser is nothing but escape sequences. PHPMailer, SimplePie and the named-character-reference tables trip the same signal.

• hash +0

  SHA-256 matches the known-good allowlist — The checksum comes from the published WordPress distribution. The allowlist answers the heuristic — but it never overrides a path-context hit such as PHP inside uploads/.