Generate

Generate

The Generate tab produces obfuscated web shells and droppers in five formats. Each generated artifact includes a unique UUID authentication key, so only you can drive it once it is deployed.

Formats

Format	Target
PHP	PHP applications
ASP	Classic ASP on IIS
ASPX	ASP.NET on IIS
JSP	Java Servlet containers (Tomcat, JBoss)
CFM	Adobe ColdFusion

Pick a format, generate the shell, and download or copy the resulting source. Variable names are randomized on each generation for basic signature evasion.

Authentication

Every generated shell includes a fresh UUID auth key. Commands are base64-encoded before being sent to the shell, and the response is decoded automatically when you drive it from the Execute tab. Save the auth key; you will need it to run commands.

The key is barred while streamer mode is on. Copy still works, so you can save it without reading it — see Settings.

Dropper mode

Dropper mode generates a small shell whose only job is to pull down and run a payload from a URL you provide. Choose how the payload runs on the target:

• In-memory: the payload is piped directly into the language interpreter. Nothing touches disk.
• On-disk: the payload is written to a temporary location, made executable if needed, and launched.

The exact on-disk location and launch mechanism depends on the format, because Windows and Unix hosts expect different things:

Format	On-disk path
PHP	/tmp/<name>
ASP	The web root, via Server.MapPath(".") (typically C:\inetpub\wwwroot\...)
ASPX	Windows user TEMP, via Path.GetTempPath() (typically C:\Windows\Temp\ or the app pool user's temp)
JSP	JVM temp dir, via System.getProperty("java.io.tmpdir") (usually /tmp on Unix, C:\Windows\Temp on Windows)
CFM	ColdFusion temp dir, via GetTempDirectory()

Dropper shells use the same UUID auth key mechanism as regular shells.

Workflow

1. Open Generate and choose a format.
2. Optionally toggle dropper mode and fill in the payload URL.
3. Generate. Save the UUID auth key and the shell source.
4. Deploy the shell to the target (uploader, RCE primitive, etc.).
5. Move to the Execute tab to run commands against it.