A family of extremely stealthy, code-golfed PHP webshells designed for undetectable remote command execution.
Nano is a family of PHP webshells that are code-golfed to be extremely small and stealthy. It provides remote command execution capabilities while evading detection by security scanners and static analysis tools. The project includes variants like Nano and Ninja, each optimized for different evasion techniques.
Security researchers, penetration testers, and red team operators who need stealthy backdoor access for authorized security assessments.
Developers choose Nano for its extreme minimalism and focus on evasion—its tiny size and clever design make it virtually undetectable by standard security tools, providing reliable access in restricted environments.
Nano is a family of PHP web shells which are code golfed for stealth.
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
The Nano variant is only 35 bytes, making it extremely easy to embed in compromised systems and hard to detect via size-based analysis, as highlighted in the README.
Specifically engineered to bypass static code scanners, with the README noting that Nano 'can't be detected by static code scanners' and Ninja is 'fully undetectable'.
Ninja variant uses HTTP headers for command delivery, increasing stealth against network-based detection, and includes a Python handler script to simplify interaction.
Includes password protection via the 'p' parameter, allowing restricted access to prevent unauthorized use, as demonstrated in the usage examples.
Focuses solely on basic command execution without built-in features like file management, database access, or error handling, which are common in more comprehensive webshells.
The Ninja variant requires base64 encoding and header manipulation, which can be error-prone without the provided handler script, as admitted in the README's 'a bit complex' note.
README is brief and lacks detailed setup instructions, troubleshooting guides, or security best practices, relying on users to figure out nuances like command encoding.
Code snippets show no error handling mechanisms, which could lead to silent failures or exposure if parameters are malformed or execution fails.