flozz/p0wny-shell

Health v2 · maintenance only

Adoption not part of the score

2860 stars · 690 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

p0wny@shell is a single-file PHP webshell that provides a browser-based terminal for executing commands on a remote server. It is designed for penetration testers to quickly gain command execution on a PHP application during authorized security assessments.

Use cases

• run commands on a server during a pentest
• test for file upload vulnerabilities in PHP apps
• get a remote shell through a browser
• upload and download files from a compromised host during an audit
• bypass disabled PHP execution functions
• demonstrate webshell risk to clients

When to choose

• you are a pentester needing a quick, single-file PHP webshell
• you want command history, tab completion, and file transfer in a minimal webshell
• you need compatibility with old PHP versions and multiple execution functions

When to avoid

• you need a legitimate remote admin tool for production servers
• you require authentication or encryption on your remote shell
• you cannot legally or ethically deploy a webshell on the target

Facets

application · maturity active

http-server security developer-tools security penetration-testing web-development php cross-platform webshell php-shell pentesting single-file red-team web-server

Member repositories

For agents

markdown · JSON · MCP: product_card(name="flozz/p0wny-shell")