# flozz/p0wny-shell

Single-file PHP shell

Repository: https://github.com/flozz/p0wny-shell
Canonical: https://ross.abutalabs.com/products/p0wny-shell
Homepage: https://blog.flozz.fr/2020/01/21/p0wny-shell-un-shell-php-simple-mais-trop-efficace/
Language: PHP
License: WTFPL
License Family: permissive
Topics: php-shell, pentesting
Last push: 2025-08-11T06:04:44+00:00

## Health v2 (maintenance only)
Score: 39/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 36, release rhythm 8, longevity 100
- inputs: {"age_days": 3584, "days_push": 387, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 2860, forks 690 (observed 2026-08-28T04:07:26.028944+00:00)

## What it is
p0wny@shell is a single-file PHP webshell that provides a browser-based terminal for executing commands on a remote server. It is designed for penetration testers to quickly gain command execution on a PHP application during authorized security assessments.

## Use cases
- run commands on a server during a pentest
- test for file upload vulnerabilities in PHP apps
- get a remote shell through a browser
- upload and download files from a compromised host during an audit
- bypass disabled PHP execution functions
- demonstrate webshell risk to clients

## When to choose
- you are a pentester needing a quick, single-file PHP webshell
- you want command history, tab completion, and file transfer in a minimal webshell
- you need compatibility with old PHP versions and multiple execution functions

## When to avoid
- you need a legitimate remote admin tool for production servers
- you require authentication or encryption on your remote shell
- you cannot legally or ethically deploy a webshell on the target

## Facets
- artifact type: application
- maturity: active
- function: http-server, security, developer-tools
- domain: security, penetration-testing, web-development
- platform: php, cross-platform
- tags: webshell, php-shell, pentesting, single-file, red-team, web-server

## Member repositories
- flozz/p0wny-shell (main) score 39

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:07:26.028944+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T07:36:27.464349+00:00, confidence not recorded.
  - readme: https://github.com/flozz/p0wny-shell (fetched 2026-08-28T04:07:26.028944+00:00, sha 448e978e3c87)
  - homepage: https://blog.flozz.fr/2020/01/21/p0wny-shell-un-shell-php-simple-mais-trop-efficace/ (fetched 2026-08-29T09:52:06.676370+00:00, sha 2c0a20d8806d)
- Data as of 2026-08-30T08:39:29.467469+00:00.