backdoor-probe Free

Requests asking for known web shells and backdoors by name (c99, r57, wso, shell.php…), whatever the answer — a search for a way in; one and out

Category

web

Threshold

1/10m

Ban policy

severe

Report

backdoor-probe

Parsers

http-backdoor-probe

Why it is written this way

The rule file View raw

# The known web shells, asked for by name (http-backdoor-probe's list):
# nobody asks for one by accident — c99.php, eval-stdin.php (the PHPUnit
# RCE), wp_filemanager.php. A SINGLE request is the verdict (Robin,
# 2026-08-20: threshold 2 assumed Plesk always double-logs; it does not
# — a redirect on the http:// side is one line), whatever the server
# answered: 404, 403, or the redirect the scan never follows. It still
# feeds php-probe and http-scan too, so a name that somehow is a real
# file adds to their counts rather than banning alone.
rule: backdoor-probe
description: "Requests asking for known web shells and backdoors by name (c99, r57, wso, shell.php…), whatever the answer — a search for a way in; one and out"
about:
  purpose: >-
    Ban a scan looking for web shells somebody else may have left on your server.
  blocks: >-
    A request for a known shell by name, whatever the server answered — a 404 means it is not there yet, not that the asking was innocent.
  applies_to: >-
    Any web server.
  requires:
    - >-
      The site's access log in combined format, declared as `log: http`.
  beware:
    - >-
      The names are those of published shells. A file of yours named like one would make your own visitors suspects; the list is worth a glance against your paths.
category: web
parsers: http-backdoor-probe
threshold: 1/10m
ban: severe
report: backdoor-probe