Alien

English | 繁體中文 | 简体中文

Alien is a modular webshell client developed for cybersecurity research and education.

It provides a unified post-exploitation framework for managing different web technologies through reusable modules.

Rather than embedding every feature inside the webshell itself, Alien treats webshells as lightweight execution layers. Once arbitrary code execution is obtained, advanced capabilities, including file management, database interaction, virtual shells, SOCKS5 proxying, plugins, and reflective loading, are provided by Alien.

If you find this project helpful or informative, I would truly appreciate a ⭐ on the repository. Your support would be a great motivation for me to continue improving this tool!

Disclaimer

Alien is developed for cybersecurity research, education, and authorized penetration testing only.

Do NOT use this project against systems without explicit authorization.

The author is not responsible for any misuse or damage caused by this software.

Architecture

Requirements

Before running Alien, please ensure the following requirements are met:

• Python 3 must be installed.
• The Python executable (python) must be accessible from the command line (added to the system PATH environment variable).

You can verify your installation by running:

python --version

Core Components

Alien consists of several independent components.

Component	Description
OneShell	A lightweight webshell responsible only for arbitrary code execution.
NebulaPulsar	An in-memory implant supporting Java and .NET reflective loading.
DarkMatter	Payload executed by NebulaPulsar.
Event Horizon	HTTP traffic obfuscation framework with wrapper injection and tamper scripts.
DriftingComet	Webshell pivoting mechanism for multi-hop communication.

Supported Web Technologies

Script	Server	Execution Method	Payload Type
PHP	Linux/Windows	v5.X	OneShell
		v7.X, v8.X	OneShell, ECDH (Elliptic Curve Diffie-Hellman)
ASP	Windows	Classic	OneShell
ASPX, ASHX, ASMX	Windows	JScript	OneShell
	Linux/Windows	NebulaPulsar	DarkMatter
JSP	Linux/Windows	Nashorn	OneShell
		NebulaPulsar	DarkMatter
JSPX	Linux/Windows	Nashorn	OneShell
		NebulaPulsar	DarkMatter
CFML	Linux/Windows	NebulaPulsar	DarkMatter
Perl	Linux/Windows	CGI	OneShell
Ruby	Linux/Windows	CGI	OneShell

Features

• File Manager
• Virtual Shell
• Database Manager
• Arbitrary Code Execution
• SOCKS5 Proxy
• Plugins
• Webshell Pivoting (DriftingComet)
• HTTP Traffic Obfuscation (Event Horizon)
• Reflective Loading (.NET/Java NebulaPulsar & DarkMatter)

Screenshots

Information

File

Shell

Database

Code Exec

Void

SOCKS5

Linux/Windows

Plugins

Note

Event Horizon

DriftingComet

Acknowledgements

Alien began as my first webshell management tool during my second year at university.

Throughout its development, I have learned a tremendous amount from open-source projects, technical articles, research papers, and the cybersecurity community. Although this project has been completely redesigned multiple times, every iteration has been a valuable learning experience.

I sincerely thank everyone who shares their knowledge with the community. Without those contributions, projects like Alien would not have been possible.