list_find_already_shell.md

Known Shell Coverage

This file documents shell families and samples that are known to be detected by the project. The list is a reference, not a guaranteed exhaustive coverage map. Some samples may also be detected through generic signatures even if they are not explicitly listed here.

Status Key

• [x] documented and known to be covered
• [ ] planned or not yet documented

Covered Samples

Status	Sample file	Family / Notes
[x]	0byt3m1n1.php	0byt3m1n1 Shell
[x]	0byteV2.php	0byteV2 Shell
[x]	0x.php	0x Shell
[x]	1337.php	1337 3YP455 Shell
[x]	2018wso.php	2018 WSO Shell
[x]	22xc.php	22XploiterCrew
[x]	22xcmini.php	22Xploiter Crew Mini
[x]	22xploiter.php	22XploiterCrew Shell
[x]	403webshell.php	403 WebShell
[x]	404 Not Found.php	404 Not Found Shell
[x]	404-mini.php	404 Not Found Mini Shell
[x]	404.php	404 Shell
[x]	407.php	407 Mini Shell
[x]	407pass.php	407 Mini Shell Pass
[x]	51mp3L.php	51mp3L Web Backdoor
[x]	adminer.php	Adminer
[x]	ak47shell.php	Ak47 Shell
[x]	ak74shell.php	AK-74 Security Team Shell
[x]	alfa.php	Alfa Shell
[x]	alfa403.php	Alfa Team Shell
[x]	angel.php	Neon Genesis Angel Shell
[x]	Ani-Shell.php	Ani Shell
[x]	anon.php	Anonymous Shell
[x]	Antichat Shell	Antichat Shell
[x]	Antichat Shell v.1.3.php	Antichat Webshell
[x]	Antichat Socks5 Server v 1.0.php	Antichat Socks5 Webserver Shell
[x]	Aria cPanel cracker version 1.0 - Edited By KingDefacer.php	Aria cPanel Cracker Shell
[x]	ASPYDrvsInfo.php	ASP.NET Shell Drive Info
[x]	ava Server Faces MiniWebCmdShell 0.2 by HeartLESS.php	Server Faces Mini Web Shell by HeartLESS
[x]	AventGrup-Sincap 1.0.php	AventGrup Sincap 1.0 Session
[x]	Ayyildiz Tim - AYT- Shell v 2.1 Biz.php	Ayyildiz Tim Shell v2.1 Biz
[x]	azrail 1.0 by C-W-M.php	Azrail 1.0 by C-W-M Shell
[x]	b374k.php	b374k
[x]	B374k Beta ShElL V1	b374k Beta Shell V1 Cyb3R_ShubhaM
[x]	b374kpriv.php	b374k Priv8
[x]	beyaz.php	Beyaz Hacker
[x]	bypass403.php	Bypass 403
[x]	c99shell.php	c99Shell by PinoyWhiz
[x]	cpanel.php	Crack cPanel
[x]	cylul	Cylul007
[x]	cyto.php	CytoXteam
[x]	dbconfig.php	DB Config
[x]	eagle.php	Black Eagle Team
[x]	eviltwin.php	Evil Twin
[x]	fierza.php	FierzaXploit
[x]	filemanager.php	File Manager Shell
[x]	foxwso.php	Fox WSO
[x]	gelay.php	Gel4y Mini Shell
[x]	indosec.php	IndoSec
[x]	indoxploit.php	IndoXploit
[x]	ipt.php	IPT Mini Shell
[x]	kerang.php	Kerang Shell
[x]	marijuana.php	Marijuana
[x]	marion001.php	Marion 001 Shell
[x]	mass.php	Mass Deface
[x]	mini.php	Mini Shell
[x]	p0wny-shell.php	P0wny Shell
[x]	predator.php	Predator
[x]	priv8.php	Priv8 Shell
[x]	ransomware.php	Ransomware
[x]	sa.php	SA Shell
[x]	saskra.php	SasKraXPloit
[x]	simattacker.php	SimAttacker v1.0.0 Edited by KingDefacer
[x]	simple-shell.php	Simple Shell
[x]	sosyete.php	Sosyete Safe Mode Bypass Shell
[x]	symlink2019.php	symlink2019
[x]	takterlihat.php	Tak Terlihat Shell
[x]	tiny.php	Tiny File Manager
[x]	tryag.php	Tryag.php Edited by KingDefacer
[x]	uploader.php	File Uploader
[x]	webadmin.php	Webadmin
[x]	whm.php	WHMcs Killer
[x]	whmhelper.php	WHM Crack Helper
[x]	wordpress.php	WpMassDeface
[x]	wso.php	WSO Shell
[x]	wsopriv.php	WSO Priv8
[x]	中国木马资源网- WwW.7jyewu.Cn	7jyewu Shell
[x]	中国木马资源网-WwW.MumaSec.TK.php	MumaSec Shell
[x]	在线 exp 专用免杀版.php	Online EXP Shell
[x]	极其隐蔽的 pHp 小马穿插在正常页面中.php	Hidden PHP Backdoor Sample
[x]	菊花聊天室.php	Silic Hacker Group Army Shell
[ ]	To be Filled	Additional samples can be added here

Notes

• This list may include variants with different extensions.
• Some shells may be detected through generic rules or heuristics instead of exact sample-specific keywords.
• Steganographic or partially obfuscated variants can still be caught when they expose matching behavior or signatures.