A web shell is a type of malicious file that is uploaded to a web server. Potential methods of infection include SQL injection or remote file inclusions via vulnerable web applications. Web shells typically contain Remote Access Tool (RAT) or backdoor functionality, allowing attackers to retrieve information about the infected host and pass commands to the back-end server via HTTP requests. China Chopper is a fairly simple backdoor in terms of components. It has two key components:the Web shell command-and-control (CnC) client binary and a text-based Web shell payload (server component). The text-based payload is so simple and short that an attacker could type it by hand right on the target server — no file transfer needed.