xl7dev/WebShell

Webshell && Backdoor Collection

https://github.com/xl7dev/WebShell · commit f7cd87feb5ef · scored 2026-11-13 · scoring prov-4+qual-2+sec-2

Dispute this score or request a re-score Full report JSON

Repository: https://github.com/xl7dev/WebShell
Commit: f7cd87feb5ef0375fc7a7cbcfea15713a3fb5c5b
Generated: 2026-11-13T23:36:33+00:00
Scorer 0.1.0, scoring prov-4+qual-2+sec-2, report schema v2

Scores

Pillar	Score	Signal	Confidence	Coverage
AI provenance (estimated AI-generated share)	0	none-detected	46%	100%
Code quality	32	poor	90%	100%
Security	35	poor	85%	100%

AI provenance

No AI attribution or AI-consistent velocity signals detected.

Explicitly attributed share (lower bound): 0.0%
Unattributed share in AI-consistent velocity bursts: 0.0%
Estimated AI-generated share: 0.0%
Stylometry index: 0.08 per 1,000 lines (narrated steps 13, placeholders 0, assistant phrasing 1, emoji 0). Reported as a signal, not scored.

Month	Lines added	Attributed to AI
2016-03	158,812	0%
2016-05	179	0%
2016-06	643	0%
2016-08	2,128	0%
2016-11	3,019	0%
2016-12	3,139	0%
2017-01	168	0%
2017-04	300	0%

Evidence

step-by-step narration comment: /* Now we make a list of the directories. */ ([Php/Ayyildiz](https://github.com/xl7dev/WebShell/blob/f7cd87feb5ef0375fc7a7cbcfea15713a3fb5c5b/Php/Ayyildiz Tim -AYT- Shell v 2.1 Biz.php#L227))
step-by-step narration comment: #STEP 0 -> Check if backdoor already installed... ([Php/Coppermi](https://github.com/xl7dev/WebShell/blob/f7cd87feb5ef0375fc7a7cbcfea15713a3fb5c5b/Php/Coppermine Photo Gallery = 1.4.3 remote cmmnds xctn.php#L212))
step-by-step narration comment: #STEP 1 -> Login... ([Php/Coppermi](https://github.com/xl7dev/WebShell/blob/f7cd87feb5ef0375fc7a7cbcfea15713a3fb5c5b/Php/Coppermine Photo Gallery = 1.4.3 remote cmmnds xctn.php#L228))
step-by-step narration comment: #STEP 2 -> Upload the malicious zip file... ([Php/Coppermi](https://github.com/xl7dev/WebShell/blob/f7cd87feb5ef0375fc7a7cbcfea15713a3fb5c5b/Php/Coppermine Photo Gallery = 1.4.3 remote cmmnds xctn.php#L249))
step-by-step narration comment: #STEP 3 -> Select an album... ([Php/Coppermi](https://github.com/xl7dev/WebShell/blob/f7cd87feb5ef0375fc7a7cbcfea15713a3fb5c5b/Php/Coppermine Photo Gallery = 1.4.3 remote cmmnds xctn.php#L315))
step-by-step narration comment: #STEP 4 -> Insert .zip file in a valid album... ([Php/Coppermi](https://github.com/xl7dev/WebShell/blob/f7cd87feb5ef0375fc7a7cbcfea15713a3fb5c5b/Php/Coppermine Photo Gallery = 1.4.3 remote cmmnds xctn.php#L352))
step-by-step narration comment: #STEP 5 -> Include the evil .zip file and launch commands... ([Php/Coppermi](https://github.com/xl7dev/WebShell/blob/f7cd87feb5ef0375fc7a7cbcfea15713a3fb5c5b/Php/Coppermine Photo Gallery = 1.4.3 remote cmmnds xctn.php#L394))
step-by-step narration comment: /* Now we make a list of the directories. */ ([Php/Matamu M](https://github.com/xl7dev/WebShell/blob/f7cd87feb5ef0375fc7a7cbcfea15713a3fb5c5b/Php/Matamu Mat.php#L78))

AI provenance describes how code was produced; it is not a quality judgment. Unless attribution is explicit, these are signals consistent with AI generation, not proof. Squash/rebase workflows, imported code, and rewritten history reduce accuracy.

Code quality

Code quality is poor: test-to-source ratio 0.00, no CI test run detected; 36% of function code in complex or long functions; 52% duplicated lines. Weakest area: testing.

Area	Score
Complexity (lizard)	34
Duplication	4
Code smells (Opengrep)	88
Tests and CI	0
Documentation	65
Type safety	40
Process (Scorecard review/maintenance)	n/a

Functions: 3,185; mean complexity 4.4, 90th percentile 10; 177 complex and 48 long functions
Duplicated lines: 51.5% of 132,182 compared
Tests: 0 test lines for 180,408 source lines (ratio 0.00); CI test commands: none detected; 0% of recent source commits also change tests
Docs missing or thin: contributing, changelog

Most complex functions:

main in osx/osx-ping-backdoor/ping.c: complexity 216, 637 lines
[actionSql in Php/WSO2.7 404 Error Web Shell.php: complexity 90, 335 lines](https://github.com/xl7dev/WebShell/blob/f7cd87feb5ef0375fc7a7cbcfea15713a3fb5c5b/Php/WSO2.7 404 Error Web Shell.php#L1610)
[actionFilesMan in Php/WSO2.7 404 Error Web Shell.php: complexity 78, 189 lines](https://github.com/xl7dev/WebShell/blob/f7cd87feb5ef0375fc7a7cbcfea15713a3fb5c5b/Php/WSO2.7 404 Error Web Shell.php#L955)
[scanneR in Php/PHPJackal v1.9.php: complexity 76, 179 lines](https://github.com/xl7dev/WebShell/blob/f7cd87feb5ef0375fc7a7cbcfea15713a3fb5c5b/Php/PHPJackal v1.9.php#L462)
brute in Php/gfs_sh.php: complexity 66, 212 lines

Security

Security posture is poor: 1 possible secret(s) in the tree, 0 only in history; 3692 high-severity SAST findings. Weakest area: sast.

Area	Score
Secrets (gitleaks, tree + history)	26
Static analysis (Opengrep)	0
Vulnerable dependencies (OSV)	100
CI workflows (zizmor)	n/a
Posture (policy, updates, signing, lockfiles)	0
OpenSSF Scorecard	n/a

Posture checks passed: lockfiles; missing: security policy, dependency updates, signed commits

Top findings

Severity	Finding	Location
high	`gitleaks/private-key`: Possible private-key secret in the current tree	SSH/custom-ssh-backdoor/test_rsa.key:1
high	`opengrep/php.lang.security.injection.echoed-request`: `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]	Php/12309.php:198
high	`opengrep/php.lang.security.injection.echoed-request`: `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]	Php/12309.php:200
high	`opengrep/php.lang.security.injection.echoed-request`: `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]	Php/12309.php:204
high	`opengrep/php.lang.security.injection.echoed-request`: `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]	Php/12309.php:228
high	`opengrep/php.lang.security.injection.echoed-request`: `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]	Php/12309.php:230
high	`opengrep/php.lang.security.injection.echoed-request`: `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]	Php/12309.php:236
high	`opengrep/php.lang.security.injection.echoed-request`: `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]	Php/12309.php:238
high	`opengrep/php.lang.security.injection.echoed-request`: `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]	Php/12309.php:243
high	`opengrep/php.lang.security.injection.echoed-request`: `Echo`ing user input risks cross-site scripting vulnerability. You should use `htmlentities()` when showing data to users. [confidence medium]	Php/12309.php:251
high	`opengrep/php.lang.security.injection.tainted-sql-string`: User data flows into this manually-constructed SQL string. User data can be safely inserted into SQL strings using prepared statements or an object-relational mapper (ORM). Manually-constructed SQL strings is a possible indicator of SQL injection, which could let an attacker steal or manipulate data [confidence medium]	Php/12309.php:251
high	`opengrep/php.lang.security.exec-use`: Executing non-constant commands. This can lead to command injection. [confidence low]	Php/12309.php:323
high	`opengrep/php.lang.security.exec-use`: Executing non-constant commands. This can lead to command injection. [confidence low]	Php/12309.php:325
high	`opengrep/php.lang.security.exec-use`: Executing non-constant commands. This can lead to command injection. [confidence low]	Php/12309.php:327
high	`opengrep/php.lang.security.exec-use`: Executing non-constant commands. This can lead to command injection. [confidence low]	Php/12309.php:329
high	`opengrep/php.lang.security.exec-use`: Executing non-constant commands. This can lead to command injection. [confidence low]	Php/12309.php:331
high	`opengrep/php.lang.security.exec-use`: Executing non-constant commands. This can lead to command injection. [confidence low]	Php/12309.php:334
high	`opengrep/php.lang.security.exec-use`: Executing non-constant commands. This can lead to command injection. [confidence low]	Php/12309.php:439
high	`opengrep/php.lang.security.exec-use`: Executing non-constant commands. This can lead to command injection. [confidence low]	Php/12309.php:441
high	`opengrep/php.lang.security.exec-use`: Executing non-constant commands. This can lead to command injection. [confidence low]	Php/12309.php:444
high	`opengrep/php.lang.security.exec-use`: Executing non-constant commands. This can lead to command injection. [confidence low]	Php/12309.php:448
high	`opengrep/php.lang.security.exec-use`: Executing non-constant commands. This can lead to command injection. [confidence low]	Php/12309.php:453
high	`opengrep/php.lang.security.weak-crypto`: Detected usage of weak crypto function. Consider using stronger alternatives. [confidence low]	Php/12309.php:609
high	`opengrep/php.lang.security.weak-crypto`: Detected usage of weak crypto function. Consider using stronger alternatives. [confidence low]	Php/12309.php:618
high	`opengrep/php.lang.security.weak-crypto`: Detected usage of weak crypto function. Consider using stronger alternatives. [confidence low]	Php/12309.php:625

Static signals only: the scorer never runs the project's code. Secret findings are pattern matches that were not verified, and secret values are never stored.

Repository profile

Source lines: 180,408; test lines: 0

Language	Lines
PHP	168,670
Python	5,823
C	3,603
Ruby	577
JavaScript	532
Shell	518
Java	332
PowerShell	316
C++	37

Embed a badge

Maintainers can show these in a README. Badges update when the repository is re-scored.

[![RepoTrust ai](https://repotrust.synapticcyber.com/badge/github.com/xl7dev/WebShell/ai.svg)](https://repotrust.synapticcyber.com/r/github.com/xl7dev/WebShell/)

[![RepoTrust quality](https://repotrust.synapticcyber.com/badge/github.com/xl7dev/WebShell/quality.svg)](https://repotrust.synapticcyber.com/r/github.com/xl7dev/WebShell/)

[![RepoTrust security](https://repotrust.synapticcyber.com/badge/github.com/xl7dev/WebShell/security.svg)](https://repotrust.synapticcyber.com/r/github.com/xl7dev/WebShell/)