Mass checking of webshells on valid.
 

1. If you need to check a lot of webshells on valid first you need to check them on http-code – we need to receive an answer if there are any page on this url. For doing this tasks we use bash,.c Php of course has more universal but it would take more time and you won’t be able to use it on hosting as time of script working os limited.
Here is listing of ready script:

#!/usr/local/bin/bash

links="/root/links.txt" # File with all the available Link
result="/root/valid.txt" # File with links, where there is a page (200 ок).


if [ -r "$links" ]; then
if [ -w "$result" ]; then
for address in $(cat $links); do
if (wget -t 1 -T 5 --spider $address &>/dev/null); then
echo $address; # Showing links with pages
echo $address >> $result;
fi
done
else
echo Cannot open $result for writing or file does not exist.
fi
else
echo Cannot open $links for reading or file does not exist.
fi

"wget -t 1 -T 5" says that we’ll try to connect with an address one time with timeout 5sec. Otherwise checking may take some days. If you wanna see more details delete "&>/dev/nul".

2. So we have a list of links where are some page. Now we need to know if there are web-shell or something else. As most of shells were from rst was decided to download pages and make grep for needed info (r57shell). Here is listing:
#!/usr/local/bin/bash

links="/root/valid.txt" # File with all links.
result="/root/result.txt" # File with links with webshells.

keyword="r57shell" # Keyword

if [ -r "$links" ]; then
if [ -w "$result" ]; then
for address in $(cat $links); do
if ( (wget -T 5 -t 1 $address -O - | grep -m 1 $keyword) &>/dev/null); then
echo $address; # Shows good links
echo $address >> $result;
fi
done
else
echo Cannot open $result for writing or file does not exist.
fi
else
echo Cannot open $links for reading or file does not exist.

fi

As you can see it’s almost the same script, only wget downloads file and then there is grep for r57shell.