# bartblaze/PHP-backdoors

A collection of PHP backdoors. For educational or testing purposes only.

Repository: https://github.com/bartblaze/PHP-backdoors
Canonical: https://ross.abutalabs.com/products/php-backdoors
Language: PHP
License: CC0-1.0
License Family: permissive
Topics: php, php-backdoor, webshell
Last push: 2024-03-09T18:03:18+00:00

## Health v2 (maintenance only)
Score: 32/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 0, release rhythm 35, longevity 100
- inputs: {"age_days": 3771, "days_push": 907, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: no_releases
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 2271, forks 465 (observed 2026-08-28T04:06:33.178746+00:00)

## What it is
A curated collection of PHP backdoor and webshell samples (e.g., c99Shell) intended for educational and testing purposes, including obfuscated and deobfuscated variants. It also links to deobfuscation tools and Yara rules for detecting such webshells on compromised servers.

## Use cases
- study php webshell samples for malware analysis
- build yara rules to detect webshells on my web server
- test my antivirus or scanner against php backdoors
- deobfuscate obfuscated php malware in a sandbox
- train a security team on recognizing backdoor behavior
- collect webshell samples for log analysis research

## When to choose
- you need real-world PHP webshell samples for security research, detection engineering, or training
- you want reference material for writing Yara detection rules
- you are studying malware obfuscation techniques in a secure lab environment

## When to avoid
- you want a tool to deploy or use backdoors on systems you do not own
- you need production-ready security tooling rather than sample artifacts
- you cannot operate in an isolated VM or sandbox, since some samples may themselves be backdoored

## Facets
- artifact type: dataset
- maturity: maintenance
- function: security, penetration-testing, developer-tools
- domain: security, penetration-testing, developer-tools
- platform: php
- tags: webshell, backdoor, malware-samples, php, yara, malware-analysis, security-research, web-server

## Member repositories
- bartblaze/PHP-backdoors (main) score 32

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:06:33.178746+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T02:41:48.061319+00:00, confidence not recorded.
  - readme: https://github.com/bartblaze/PHP-backdoors (fetched 2026-08-28T04:06:33.178746+00:00, sha 4594465cc348)
- Data as of 2026-08-30T08:39:29.467469+00:00.