Alien is a modular webshell client developed for cybersecurity research and education. It provides a unified post-exploitation framework for managing different web technologies through reusable modules.
Core Components
Alien consists of several independent components.
| Component | Description |
|---|---|
| OneShell | A lightweight webshell responsible only for arbitrary code execution. |
| NebulaPulsar | An in-memory implant supporting Java and .NET reflective loading. |
| DarkMatter | Payload executed by NebulaPulsar. |
| Event Horizon | HTTP traffic obfuscation framework with wrapper injection and tamper scripts. |
| DriftingComet | Webshell pivoting mechanism for multi-hop communication. |
Supported Web Technologies
| Script | Server | Execution Method | Payload Type |
|---|---|---|---|
| PHP | Linux/Windows | v5.X | OneShell |
| v7.X, v8.X | OneShell, ECDH (Elliptic Curve Diffie-Hellman) | ||
| ASP | Windows | Classic | OneShell |
| ASPX, ASHX, ASMX | Windows | JScript | OneShell |
| Linux/Windows | NebulaPulsar | DarkMatter | |
| JSP | Linux/Windows | Nashorn | OneShell |
| NebulaPulsar | DarkMatter | ||
| JSPX | Linux/Windows | Nashorn | OneShell |
| NebulaPulsar | DarkMatter | ||
| CFML | Linux/Windows | NebulaPulsar | DarkMatter |
| Perl | Linux/Windows | CGI | OneShell |
| Ruby | Linux/Windows | CGI | OneShell |
Features
- File Manager
- Virtual Shell
- Database Manager
- Arbitrary Code Execution
- SOCKS5 Proxy
- Plugins
- Webshell Pivoting (DriftingComet)
- HTTP Traffic Obfuscation (Event Horizon)
- Reflective Loading (.NET/Java NebulaPulsar & DarkMatter)
Screenshots
Information
File
Shell
Database
Code Exec
Void
SOCKS5
Linux/Windows
Plugins
Note
Event Horizon
DriftingComet
Top comments (0)