PE-BEH
Behinder
Java-based GUI client for administering an authorized web shell over a dynamically encrypted, memory-capable channel.
OVERVIEW
Behinder (冰蝎, roughly 'ice scorpion'), maintained at github.com/rebeyond/Behinder, is a Java-based desktop client for administering a web shell whose most distinctive feature is per-session dynamic encryption: rather than sending a fixed, easily fingerprinted payload, client and stub negotiate a symmetric key so that every connection's traffic looks different, and later versions can inject a shell stub straight into process memory instead of writing a static file to disk.
The repository has no published license file, so it should be treated as source-available rather than under any specific open-source license — teams should not assume rights to redistribute or modify it beyond GitHub's default terms of service. As with any webshell client, it is covered here strictly for administering a stub that has already been authorized and placed on a target during a scoped, agreed post-exploitation phase.
USE CASES
Practical use cases
- 01
Managing an authorized web shell session through an encrypted channel that resists naive signature-based network detection.
- 02
Interacting with a memory-resident shell stub to avoid leaving a static file artifact on disk during the authorized window.
- 03
Demonstrating to a client how an encrypted, C2-style channel evades a WAF or IDS rule tuned only for plaintext webshell traffic.
- 04
Comparing detection coverage against an encrypted client like Behinder versus a plaintext one during a purple-team exercise.
QUICK START
Once a test web shell stub has been authorized and placed as part of an agreed post-exploitation phase, to manage the session through an encrypted channel that is harder to signature-match than a plaintext shell client.
- Confirm the rules of engagement explicitly authorize an encrypted-channel web shell for this phase, including which detection scenarios the client wants tested.
- Download and run the Behinder client (requires a Java runtime) on the tester's workstation.
- Add a connection profile pointing to the already-placed, authorized shell stub and its matching encryption key.
- Use the file, terminal, and (where available) database modules, logging every action for the report.
- Remove the stub and revoke the connection profile once the authorized window closes.
BEFORE YOU RUN IT
What to check before running it
The repository ships no license file, so treat it as source-available rather than open-source when deciding how it can be redistributed or modified inside a tooling pipeline.
The encrypted, sometimes memory-only channel is specifically designed to evade naive network monitoring — document this explicitly for the blue team's debrief so the encrypted-C2 detection gap is understood, not treated as a clean pass.
Placing any web shell must be logged with the client, time-boxed to the agreed window, and removed — including any memory-resident stub, which won't survive a reboot but should still be tracked — before the engagement closes.