Weevely
Stealthy PHP web shell & manager.
KaliParrothigh
pkg: weevely
Weevely generates an obfuscated PHP backdoor and provides a remote terminal with modules for post-exploitation on web servers.
Syntax
weevely generate {pass} {agent.php} → weevely {url} {pass}
Example
weevely generate s3cret shell.php
Builds an obfuscated PHP agent you upload; connect back with `weevely <url> s3cret`.
Advantages
- Stealthy, obfuscated web shell
- 30+ post-ex modules
- Persistent web-server foothold
Disadvantages
- Requires an upload/RCE vector first
- PHP targets only
- Strict authorization needed
Tags
#web-shell#php#post-ex
Official docs: Weevely ↗
Related commands
Frequently asked questions
What is Weevely used for?
Weevely generates an obfuscated PHP backdoor and provides a remote terminal with modules for post-exploitation on web servers.
What is an example Weevely command?
A common example is: weevely generate s3cret shell.php — Builds an obfuscated PHP agent you upload; connect back with `weevely <url> s3cret`.
Is Weevely part of Kali Linux?
Yes. Weevely ships with Kali Linux (and Parrot OS). If missing, install it with: sudo apt install weevely.
What category of security tool is Weevely?
Weevely is a Post-Exploitation tool with a high-risk profile when run against a live target.
Try recon tools live
Run real scans against a domain you control, stage by stage.