The wsmemshell repository presents a novel approach to in-memory shell and webshell deployment using WebSocket technology. Written primarily in Java, this project implements what the author describes as a new type of memory shell and webshell technique, specifically designed to operate through WebSocket connections rather than traditional HTTP-based approaches.
The project has been tested for compatibility across multiple Java application servers and frameworks. According to the documentation, it successfully operates on Tomcat, Spring, Jetty, WebSphere, WebLogic, and Resin. Node.js support exists but requires code modification and service restart rather than dynamic injection. JBoss and WildFly remain untested at the time of documentation. The repository addresses several practical deployment challenges that have evolved through development iterations. Earlier limitations involving Nginx proxies without proper WebSocket header forwarding have been resolved, as have constraints related to CDN deployments where providers did not support WebSocket services. The project also evolved beyond requiring direct memory injection, now supporting JSP file connections to WebSocket proxies, which is documented in the BypassNginxCDN directory.
The repository contains multiple detailed technical guides covering different aspects of the implementation. These include comprehensive introductions to WebSocket memory shells, documentation on WebSocket proxy functionality, implementation details for multi-functional shell capabilities, and specific guidance for deploying WebSocket JSP shells that can bypass Nginx and CDN proxy restrictions without requiring direct code injection into running services. This modular documentation approach allows users to understand both the foundational concepts and specific deployment scenarios.
The project is affiliated with Anhan's Starfire Laboratory, a team focused on practical offensive and defensive security research. The laboratory emphasizes real-world attack and defense scenarios, threat intelligence, attack simulation, and threat analysis, with team members drawn from experienced red team, blue team, and purple team professionals. This institutional backing reflects the project's positioning within professional security research rather than casual development.
The primary contributor veo has logged seven tracked events, demonstrating sustained involvement in the project's development and community interaction. The project maintains a homepage at veo.pub providing additional context and detailed technical information beyond what appears in the repository itself.
