Alien is a modular webshell client developed for cybersecurity research and education.
It provides a unified post-exploitation framework for managing different web technologies through reusable modules.
Rather than embedding every feature inside the webshell itself, Alien treats webshells as lightweight execution layers. Once arbitrary code execution is obtained, advanced capabilities, including file management, database interaction, virtual shells, SOCKS5 proxying, plugins, and reflective loading, are provided by Alien.
If you find this project helpful or informative, I would truly appreciate a ⭐ on the repository. Your support would be a great motivation for me to continue improving this tool!
Alien is developed for cybersecurity research, education, and authorized penetration testing only.
Do NOT use this project against systems without explicit authorization.
The author is not responsible for any misuse or damage caused by this software.
Before running Alien, please ensure the following requirements are met:
- Python 3 must be installed.
- The Python executable (
python) must be accessible from the command line (added to the systemPATHenvironment variable).
You can verify your installation by running:
python --versionAlien consists of several independent components.
| Component | Description |
|---|---|
| OneShell | A lightweight webshell responsible only for arbitrary code execution. |
| NebulaPulsar | An in-memory implant supporting Java and .NET reflective loading. |
| DarkMatter | Payload executed by NebulaPulsar. |
| Event Horizon | HTTP traffic obfuscation framework with wrapper injection and tamper scripts. |
| DriftingComet | Webshell pivoting mechanism for multi-hop communication. |
| Script | Server | Execution Method | Payload Type |
|---|---|---|---|
| PHP | Linux/Windows | v5.X | OneShell |
| v7.X, v8.X | OneShell, ECDH (Elliptic Curve Diffie-Hellman) | ||
| ASP | Windows | Classic | OneShell |
| ASPX, ASHX, ASMX | Windows | JScript | OneShell |
| Linux/Windows | NebulaPulsar | DarkMatter | |
| JSP | Linux/Windows | Nashorn | OneShell |
| NebulaPulsar | DarkMatter | ||
| JSPX | Linux/Windows | Nashorn | OneShell |
| NebulaPulsar | DarkMatter | ||
| CFML | Linux/Windows | NebulaPulsar | DarkMatter |
| Perl | Linux/Windows | CGI | OneShell |
| Ruby | Linux/Windows | CGI | OneShell |
- File Manager
- Virtual Shell
- Database Manager
- Arbitrary Code Execution
- SOCKS5 Proxy
- Plugins
- Webshell Pivoting (DriftingComet)
- HTTP Traffic Obfuscation (Event Horizon)
- Reflective Loading (.NET/Java NebulaPulsar & DarkMatter)
Alien began as my first webshell management tool during my second year at university.
Throughout its development, I have learned a tremendous amount from open-source projects, technical articles, research papers, and the cybersecurity community. Although this project has been completely redesigned multiple times, every iteration has been a valuable learning experience.
I sincerely thank everyone who shares their knowledge with the community. Without those contributions, projects like Alien would not have been possible.