Metadata-Version: 2.4
Name: webshell-analyzer
Version: 1.0.1
Summary: Webshell Detection Tool integrating Machine Learning based on Static Feature Extraction
Author-email: Adelia Saputri <adelias.dev@gmail.com>
License: MIT License
        
        Copyright (c) 2026 Adelia saputri
        
        Permission is hereby granted, free of charge, to any person obtaining a copy
        of this software and associated documentation files (the "Software"), to deal
        in the Software without restriction, including without limitation the rights
        to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
        copies of the Software, and to permit persons to whom the Software is
        furnished to do so, subject to the following conditions:
        
        The above copyright notice and this permission notice shall be included in all
        copies or substantial portions of the Software.
        
        THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
        IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
        FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
        AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
        LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
        OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
        SOFTWARE.
        
Keywords: webshell,detection,machine learning,security,php
Classifier: Programming Language :: Python :: 3
Classifier: License :: OSI Approved :: MIT License
Classifier: Operating System :: OS Independent
Classifier: Topic :: Security
Classifier: Intended Audience :: System Administrators
Requires-Python: >=3.8
Description-Content-Type: text/markdown
License-File: LICENSE
Requires-Dist: pandas
Requires-Dist: scikit-learn
Requires-Dist: colorama
Requires-Dist: pyfiglet
Requires-Dist: joblib
Dynamic: license-file

# Webshell Analyzer
webshell analyzer is command line based webshell detection tool that utillizes static feature extraction and using Random Forest classification to detect malicious PHP webshell.

![Webshell Analyzer Home Screen](/assets/images/home_screen.png "Home Screen")

## Table of Contens
- [About](#about)
- [Features](#features)
- [Requirements](#requirements)
- [Instalation](#installation)
- [Usage](#usage)
- [Commands](#commands)
- [Example Output](#example-output)

## About
webshell analyzer was developed to assist security analysts, researchers, and system administrators in identifying potentially malicious PHP files before they are executed on a web server. the tool helps to mitigate the risk of unauthorised access, web defacement attacks, and persistent backdoor attacks, which are commonly associated with webshells.

this system combines three static code analysis methods: lexical analysis, statistical analysis, and Abstract Syntax Tree (AST) analysis. this approach enables the detection process to identify suspicious functions, code structure patterns, and statistical characteristics that may indicate malicious behavior.

## Features
- Scan individual PHP files for webshell indicators
- Recursively scan entire directories
- Static feature extraction (no code execution required)
- Machine learning classification using Random Forest
- Export results to only JSON file
- Interactive CLI environment

## Requirements
before installing and running webshell analyzer, ensure that your system meets the following requirements :

- Python 3.10 or later
- Pip (python package manager)
- Git

## Installation

### Option 1 — Via pip (Recommended)

The easiest way to install Webshell Analyzer is via pip:

```bash
pip install webshell-analyzer
```
All required dependencies will be installed automatically.

### Option 2 — Via GitHub Clone

```bash
# Clone the repository
git clone https://github.com/Adeliasaputriiii/webshell-analyzer

# Navigate to the project directory
cd webshell-analyzer

# Install dependencies
pip install -r requirements.txt

# Install the package
pip install .
```

## Usage
Use the following command to launch the webshell analyzer interactive environment :

```wsanalyzer```

once started, you will be presented with the webshell analyzer command prompt. From this environment, you can run all available commands such as `scan`, `detect`, `--output`, `help`, `exit`.

## Commands
1. ```scan <directory_path> [--output <output_file.json>]``` -> scan all PHP files in a directory for webshell detection
2. ```detect <file_path> [--output <output_file.json>]``` -> detect a specific file for webshell activity
3. ```help``` -> for show this help message
4. ```exit``` -> For Exit the Webshell Analyzer
5. ```--output <output_file.json>``` -> Save the detection results to a JSON file

## Example Output
![Process Detecting Single file PHP](/assets/images/detectFile.png "detecting File")
