⚠️ Overview

B4ckdoor is a malicious web crawler and exploitation tool designed to automatically identify and compromise web applications by targeting known backdoor scripts. First documented in security research from 2018, the tool is actively maintained on GitHub (e.g., repository B4ckdoor by user m0nad, with over 150 stars) and is frequently used by threat actors for post‑exploitation persistence and lateral movement.

🔧 Technical Capabilities

The tool systematically scans web servers for common backdoor file names such as c99.php, r57.php, shell.php, and adminer.php by sending GET requests to thousands of known paths. Once a match is found, B4ckdoor attempts to verify the presence of a shell by checking for specific responses (e.g., the string “

📜 History & Notable Incidents

B4ckdoor was first publicly released in mid‑2018 on GitHub under the MIT license, but it has since been forked multiple times by malicious actors. In 2020, a large‑scale campaign targeting outdated WordPress plugins used B4ckdoor to deploy coin miners, documented by researchers at Sucuri (CVE‑2020‑25213 related to file upload vulnerabilities). A 2021 report from Imperva linked B4ckdoor to a series of attacks against Joomla installations, compromising over 2,000 sites within a single month. The tool’s source code has also been integrated into botnets such as Mirai variants for IoT exploitation.

🔍 Detection Indicators

Primary detection indicators include the User‑Agent string Mozilla/5.0 (compatible; B4ckdoor/1.0) and variants like B4ckdoor/2.0. The tool generates a consistent request pattern: first a HEAD request to check server type, then nested GET requests to a large set of path sequences (e.g., /wp-content/plugins/, /administrator/). Behavioral fingerprints include rapid sequential requests for non‑existent pages and repeated attempts to access /shell.php or /c99.php with random query strings.

☠️ Risk & Impact

Successful exploitation via B4ckdoor grants an attacker full remote code execution on the targeted web server, allowing data theft, defacement, malware installation, and enrollment in botnets. The tool can also be used to pivot to internal networks, escalate privileges, and maintain long‑term persistence through web shells. In 2020–2021, it was responsible for the compromise of tens of thousands of sites, leading to significant data breaches and server blacklisting.

🛡️ Mitigation

B4ckdoor is blocked immediately upon detection because its sole purpose is to locate and exploit backdoor files, representing an unequivocal and imminent threat of complete server compromise. Any request matching its User‑Agent string or exhibiting its characteristic scan pattern should be dropped by WAF or web server access controls without further analysis.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the bots listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.