# SPDX-License-Identifier: AGPL-3.0-only
# Asking for a web shell by name — c99.php, alfa-rex.php, cmd.jsp and
# two hundred others. CrowdSec's backdoors list, matched on the FILENAME
# rather than anywhere in the path, so a directory that happens to
# contain one of these words does not count.
#
# Nobody arrives at these by accident and nobody links to them. A single
# request is a verdict: whoever sent it already believes this machine is
# compromised, and is checking whether their shell is still there.
# Counted on 404 and 403 AND on 301/302 (Robin, 2026-08-20): a scan
# walking the http:// side gets a redirect for every name and never
# follows it — the redirect is the same confession. 200 is left out:
# a few of the short names (css.php, log.php, password.php) exist as
# real files on real sites.
parser: http-backdoor-probe
log: http
prefilter_any: [".php", ".asp", ".jsp", ".pl"]
regex: '^(?P<ip>\S+) \S+ \S+ \[(?P<time>[^\]]+)\] "(?P<method>[A-Z]+) (?P<path>[^ "?]*/(?i:this_is_a_new_hello_world\.php|hellopress/wp_filemanager\.php|wp_filemanager\.php|wp\-configs\.php|wp\-is\.php|Ajax_PHP_Command_Shell\.php|obfuscated\-punknopass\.php|Mackers_Private_Shell\.php|NetworkFileManagerPHP\.php|PerlWebShellbyRST\-GHC\.pl|Simple_PHP_backdoor\.php|configkillerionkros\.php|filesystembrowser\.aspx|STNC_WebShell_v0\.8\.php|Loaderz_WEB_Shell\.php|Worse_Linux_Shell\.php|cpg_143_incl_xpl\.php|Php_Backdoor\.txt\.php|Non\-alphanumeric\.php|Moroccan_Spamers\.php|Safe_Mode_Bypass\.php|Rootshell\.v\.1\.0\.php|Small_Web_Shell\.php|c99\-shadows\-mod\.php|SnIpEr_SA\ Shell\.php|simple\-backdoor\.php|Gamma_Web_Shell\.php|JspWebshell\ 1\.2\.jsp|JspWebshell_1\.2\.php|itsecteam_shell\.php|KA_uShell_0\.1\.6\.php|Antichat_Shell\.php|soldierofallah\.php|FaTaLisTiCz_Fx\.php|g00nshell\-v1\.3\.php|aZRaiLPhp_v1\.0\.php|Safe0ver_Shell\.php|PHPRemoteView\.php|CWShellDumper\.php|Private\-i3lue\.php|NTDaddy_v1\.9\.php|ru24_post_sh\.php|c99\-Ultimate\.php|toolaspshell\.asp|bdotw44shell\.php|php\-backdoor\.php|CrystalShell\.php|GRP_WebShell\.php|c99unlimited\.php|dC3_Security\.php|qsd\-backdoor\.php|connect\-back\.php|cihshell_fix\.php|Ayyildiz_Tim\.php|c99_locus7s\.php|ZyklonShell\.php|fileupload\.aspx|xleet\-shell\.php|punk\-nopass\.php|simattacker\.php|c99_w4cking\.php|elmaliseker\.asp|c99madshell\.php|simple_cmd\.php|aspxshell\.aspx|Sincap_1\.0\.php|WinX_Shell\.php|c99_PSych0\.php|alfa\-rex\.php56|cybershell\.php|eval\-stdin\.php|bloodsecv4\.php|Dive_Shell\.php|c99_madnet\.php|backupsql\.php|iskorpitx\.php|PHANTASMA\.php|Ani\-Shell\.php|cmd_win32\.jsp|DTool_Pro\.php|punkholic\.php|s72_Shell\.php|NCC\-Shell\.php|ironshell\.php|CasuS\-1\.5\.php|cgitelnet\.php|zacosmall\.php|PHPJackal\.php|PHP_Shell\.php|Predator\.php|cmdexec\.aspx|filesman\.php|jspShell\.jsp|upl0ader\.php|c99shell\.php|alfa\-rex\.php|wso2\.8\.5\.php|jspshell\.jsp|safe0ver\.php|antichat\.php|cbfphpsh\.php|cgitelnet\.pl|ex0shell\.php|spyshell\.php|up_win32\.jsp|password\.php|SimShell\.php|lolipop\.php|g00nv13\.php|spexec\.aspx|browser\.jsp|zehir4\.aspx|spygrup\.php|liz0zim\.php|wp\-term\.php|MyShell\.php|aspydrv\.php|ntdaddy\.asp|megabor\.php|weevely\.php|aspydrv\.asp|Locus7s\.php|Crystal\.php|indosec\.php|sosyete\.php|bypass\.php|RemExp\.asp|hacker\.php|zehir4\.asp|matamu\.php|lostDC\.php|upfile\.php|lifkaS\.php|ctt_sh\.php|zehir\.aspx|Ekin0x\.php|sniper\.php|PHVayv\.php|andela\.php|pHpINJ\.php|zehir4\.php|sh3llx\.php|PHPSPY\.php|PhpSpy\.php|hkrkoz\.php|aspxSH\.asp|tryag\.php|c99v2\.php|angel\.php|locus\.php|stres\.php|jspbd\.jsp|smevk\.php|shell\.php|AK\-74\.php|c99ud\.php|zehir\.asp|3fexe\.asp|alfa3\.php|xleet\.php|kral\.php|acid\.php|ASpy\.asp|EFSO\.asp|erne\.php|cmd\.aspx|list\.jsp|1337\.php|tool\.asp|r00t\.php|ddos\.php|sql\.aspx|c100\.php|isko\.php|root\.php|css\.php|c37\.php|b37\.php|pws\.php|egy\.php|r58\.php|list\.pl|wewo\.pl|log\.php|NGH\.php|dra\.php|mma\.php|cmd\.asp|bug\.php|c66\.php|cmd\.jsp|cmd\.php|150\.php|r57\.php|upl\.php|udp\.php|c99\.php|co\.php|xx\.php|cmd\.pl|ee\.php|G5\.php|dq\.php|Dx\.php|up\.asp|ws\.php|up\.jsp|pws\.pl|irc\.pl|1\.php|dc\.pl|c\.php|up\.pl|t4))(?:\?(?P<query>[^ "]*))? [^"]*" (?:30[12]|40[34]) \S+ "[^"]*" "(?P<ua>[^"]*)"$'
time_field: time
time_format: nginx
