What Is a Web Shell and How It Is Found on a Joomla Site

A web shell is a malicious script that an attacker uploads to a site after a hack. With its help they can manage files, the database and send commands to the server through an ordinary browser. Externally a web shell looks like a legitimate PHP file and is often disguised as Joomla system components. We have cleaned web shells from more than 350 Joomla sites and we know all the typical places they are hidden.

How a Web Shell Gets onto a Site

The most common scenario is uploading through a vulnerability in a component or plugin. It can be an image upload form, an insecure REST API or a vulnerability in an old extension. The second path is stealing an administrator password and uploading a file through the media manager.

After the upload the attacker gets permanent access to the site. Even if you change the administrator password, the web shell will continue to work because it does not depend on Joomla accounts.

Where Web Shells Are Most Often Hidden

Experienced attackers rarely leave a malicious file in the site root. Usually the web shell is hidden in directories with cache, temporary files or in upload folders. Typical places:

• The cache, tmp, logs folders — there are many files there, and a new script easily gets lost.
• The images and media directories — the attacker disguises the shell as an image.
• Inside legitimate Joomla files — the code is added to the beginning or end of index.php.

Signs of a Web Shell

It is difficult to detect a web shell on your own, but there are indirect signs:

• The appearance of new files with suspicious names: wso.php, shell.php, cmd.php, config.bak.php.
• A sharp increase in server load without a growth in traffic.
• Changes to files outside working hours.
• The appearance in the logs of requests to files you did not create.

How Specialists Find and Remove Web Shells

Removing a web shell manually is a bad idea. If the attacker left several copies, you will remove one, and the others will continue to work. A professional cleanup is built like this:

• Scanning all the site files against malicious code signatures.
• Checking the database for embedded scripts.
• Analyzing the server logs to find the entry point.
• Removing all the found shells and closing the vulnerability.

Only after a full cleanup can we talk about security. If you simply delete one file, the attacker will return through a backup entrance.

"One web shell is not just a file. It is a door through which the attacker will return again if it is not closed properly."

Where to Go for Removal

If the site has already been hacked or you suspect a web shell — do not try to clean it manually. The Malicious Code Removal service includes scanning all the files, checking the database and removing shells, backdoors and hidden scripts. If the infection is deep, we connect Virus Removal — we usually close such cases in 1–2 days, urgent ones in 2–4 hours.

After the cleanup we be sure to close the vulnerability through which the attacker got onto the site — otherwise the web shell will return. This is the Joomla Security and Firewall service with a 30-day guarantee.