rebeyond/Behinder

Health v2 · maintenance only

Flags: no_license

Adoption not part of the score

6191 stars · 959 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-29, confidence not recorded

Behinder ('冰蝎') is a cross-platform Java client for managing encrypted webshells on compromised web servers running PHP, Java, or .NET. It uses dynamic binary encryption to obfuscate command-and-control traffic over HTTP and supports features like SOCKS proxy tunneling, file management, and command execution.

Use cases

• manage encrypted webshells during authorized penetration tests
• establish an encrypted HTTP tunnel to a compromised web server
• run commands and browse files on a server through a webshell
• create a SOCKS proxy through a compromised web host
• evade webshell traffic detection with encrypted C2 communication

When to choose

• you are doing authorized red-team or penetration testing against web servers
• you need encrypted, evasive webshell traffic across PHP, Java, and .NET targets
• you want a single cross-platform client (JRE 8+) for managing multiple webshells

When to avoid

• you need a general-purpose web vulnerability scanner or recon tool
• you want a fully stealthy C2 framework with advanced post-exploitation modules
• you cannot legally or ethically use offensive tooling — this is dual-use and easily abused

Facets

application · maturity maintenance

security penetration-testing http-client proxy cryptography penetration-testing security web-development cross-platform jvm cli webshell webshell-manager red-team post-exploitation traffic-encryption java php asp-net socks-proxy c2

Member repositories

For agents

markdown · JSON · MCP: product_card(name="rebeyond/Behinder")