Skip to content

The BackDoor of WebHole gives you the power to control websites and apps built with PHP, Flask, Django, and Go using the HTTP/HTTPS protocol. By sending files, tokens, and commands via POST/GET on port 80 or 443, users can perform tasks like editing, executing, or downloading files.

Notifications You must be signed in to change notification settings

yasserbdj96/WebHole

Folders and files

NameName
Last commit message
Last commit date

Latest commit

Β 

History

26 Commits
Β 
Β 
Β 
Β 
Β 
Β 
Β 
Β 
Β 
Β 
Β 
Β 
Β 
Β 
Β 
Β 
Β 
Β 

Repository files navigation

hiphp by yasserbdj96

πŸ•³οΈ WebHole - Remote File System Explorer

WebHole is an advanced, open-source remote access and control tool designed for modern web environments. Unlike its predecessor HIPHP, which was limited to PHP, WebHole supports multiple server-side languages, including PHP, Flask (Python), Go (Golang), and Django, offering unmatched flexibility for developers and administrators.

By injecting a small piece of codeβ€”referred to as the WebHole Hole Codeβ€”into your project, WebHole enables secure communication over HTTP/HTTPS using POST or GET methods, typically over port 80 or 443. This allows authorized users to perform operations such as file management, script execution, configuration editing, and more, all remotely and in real-time.

Key features include:

  • βœ… Multi-Language Support: Seamlessly works with PHP, Python (Flask & Django), and Go.

  • πŸ” Password-Protected Access: Ensures only authorized users can control the server.

  • 🧱 Modular Architecture: Easily extend or adapt to new environments and frameworks.

  • 🌍 Remote File Execution & Editing: Modify, run, and manage files from any location.

  • πŸ“¦ Zero-Dependency Setup: No need for third-party softwareβ€”just plug the hole code into your project.

Originally inspired by the limitations of HIPHP, WebHole is built for developers, security professionals, and system admins who need granular control over diverse web stacksβ€”without relying on external tools or services.

Whether you're managing a single PHP site or a multi-framework infrastructure, WebHole empowers you with a unified, secure, and developer-friendly backdoor solution.

πŸ“¦ Components

Client-Side (main.py)

usage: main.py [-h] [--KEY KEY] [--URL URL] [--HOLE HOLE] [--NKEY NKEY] [--PKGS]

Webhole Command-Line Interface: Configure keys, URLs, and manage packages.

options:
  -h, --help                   Show this help message and exit.
  --KEY KEY, --key KEY         Authentication key used for secure operations. Can be provided via the KEY environment variable.
  --URL URL, --url URL         Target URL for the operation. Can be provided via the URL environment variable.
  --HOLE HOLE, --hole HOLE     Hole identifier or reference. Can be provided via the HOLE environment variable.
  --NKEY NKEY, --nkey NKEY     New authentication key for updating or replacing an existing key. Can be provided via the NKEY environment variable.       
  --PKGS, --pkgs               Display all installed packages in Webhole. Can be enabled via the PKGS environment variable.

Server-Side (hole.[py,php,go...])

# Flask server configuration
endpoint: "/"
authentication:
  method: "User-Agent header"
  key: "__key__"  # Replace with your secret key
execution:
  commands: 
    - "ls"
    - "cd"
    - "tree"
    - "cat"

βš™οΈ Setup & Usage

  1. Setup
# Clone the WebHole repository
git clone https://github.com/yasserbdj96/WebHole.git

# Navigate to the project directory
cd WebHole

# Install the required dependencies
pip install -r requirements.txt
  1. Client Connection
# Connect to an existing WebHole instance
python main.py --URL="http://server-ip:port" --KEY="your_secret_key"

# Display installed packages on the WebHole
python main.py --pkgs
# Example output:
# go-http-server   β†’ 0.0.1-beta
# php              β†’ 0.0.2-beta
# python-django    β†’ 0.0.0-beta
# python-flask     β†’ 0.0.2-beta

# Create a new WebHole code for a specific platform (Flask, Django, Go, PHP, etc.)

# Without a password (you can set one manually later):
python main.py --hole="package_name"

# With a specified password (encrypted automatically):
python main.py --hole="package_name" --nkey="your_new_key"

🌐 Supported Operations

Command Description Example *go-http-server *php *python-django *python-flask
[COMMAND] Put your command [COMMAND] βœ… βœ… βœ… βœ…
ls List directory contents ls βœ… βœ… βœ… βœ…
cd Change directory cd [PATH] ❌ βœ… βœ… βœ…
tree Show directory tree tree ❌ βœ… βœ… βœ…
tree -f Display directory structure in a tree format with full paths tree -f ❌ βœ… βœ… βœ…
cat Display file content cat [file] ❌ βœ… βœ… βœ…
hole Display HOLE Code hole βœ… βœ… βœ… βœ…
-v Show version information -v βœ… βœ… βœ… βœ…
-h Show help -h βœ… βœ… βœ… βœ…
exit Exit the shell exit βœ… βœ… βœ… βœ…

πŸ”’ Security Features

  • MD5-hashed authentication keys
  • Secure command execution sandbox
  • Encrypted communication
  • Restricted command whitelisting

πŸ“‚ Directory Structure

webhole/
β”‚   CHANGELOG
β”‚   config.json
β”‚   logo.png
β”‚   main.py
β”‚   README.md
β”‚   requirements.txt
β”‚   version.txt
β”œβ”€β”€β”€Tasks
β”‚       django_server.py
β”‚       flask_server.py
β”‚       go_server.go
β”‚       php_server.php
β”‚       servers_config.json
β”‚       server_launcher.py
└───webhole
    β”‚   messages.json
    β”‚   __init__.py
    β”‚   __version__.py
    β”‚
    β”œβ”€β”€β”€modules
    β”‚       del_line_startswith.py
    β”‚       tomd5.py
    β”‚       url_fix.py
    β”‚
    └───packages
        β”œβ”€β”€β”€go-http-server
        β”‚       config.json
        β”‚       hole.go
        β”‚       ls.go
        β”‚
        β”œβ”€β”€β”€php
        β”‚       cat.php
        β”‚       cd.php
        β”‚       config.json
        β”‚       hole.php
        β”‚       ls.php
        β”‚       tree.php
        β”‚       tree_f.php
        β”‚
        β”œβ”€β”€β”€python-django
        β”‚       cat.py
        β”‚       cd.py
        β”‚       config.json
        β”‚       hole.py
        β”‚       ls.py
        β”‚       tree.py
        β”‚       tree_f.py
        β”‚
        β”œβ”€β”€β”€python-flask
        β”‚       cat.py
        β”‚       cd.py
        β”‚       config.json
        β”‚       hole.py
        β”‚       ls.py
        β”‚       tree.py
        β”‚       tree_f.py
        β”‚
        └───__functions__
                fn_listsort.py

πŸ’» Example Session

β”Œβ”€β”€(python-flask@example.com)──[/home/user]
└─WEBHOLE> ls
πŸ“„ CHANGELOG           |    πŸ“„ config.json         |    πŸ“„ logo.png            
πŸ“„ main.py             |    πŸ“„ README.md           |    πŸ“„ requirements.txt
πŸ“ Tasks               |    πŸ“„ version.txt         |    πŸ“ versions            
πŸ“ webhole
β”Œβ”€β”€(python-flask@example.com)──[/home/user]
└─WEBHOLE> cd Tasks
β”Œβ”€β”€(python-flask@example.com)──[/home/user/Tasks]
└─WEBHOLE> tree
.
β”œβ”€β”€β”€ django_server.py
β”œβ”€β”€β”€ flask_server.py
β”œβ”€β”€β”€ go_server.go
β”œβ”€β”€β”€ php_server.php
β”œβ”€β”€β”€ server_launcher.py
└─── servers_config.json
β”Œβ”€β”€(python-flask@example.com)──[/home/user/Tasks]
└─WEBHOLE> tree -f
rrw-rw-rw- Jun 18 14:54     1.54 KB django_server.py
rrw-rw-rw- Jun 18 14:52     1.30 KB flask_server.py
rrw-rw-rw- Jun 18 15:20     2.30 KB go_server.go
rrw-rw-rw- Apr 07 21:22   655 bytes php_server.php
rrw-rw-rw- Jun 18 15:03   528 bytes servers_config.json
rrw-rw-rw- Jun 18 14:54     3.00 KB server_launcher.py
β”Œβ”€β”€(python-flask@example.com)──[/home/user/Tasks]
└─WEBHOLE> cat servers_config.json
{
  "flask": {
    "enabled": true,
    "host": "127.0.0.1",
    "port": 81,
    "entry": "flask_server.py"
  },
  "php": {
    "enabled": true,
    "host": "127.0.0.1",
    "port": 82,
    "php_path": "C:\\xampp\\php\\php.exe",
    "root": ".",
    "entry": "php_server.php"
  },
  "go": {
    "enabled": true,
    "entry": "go_server.go",
    "host": "127.0.0.1",
    "port": 83
  },
  "django": {
    "enabled": true,
    "host": "127.0.0.1",
    "port": 84,
    "entry": "django_server.py"
  }
}

Screenshots:

Preview Preview

🚨 Warning

Always use in trusted environments - command execution capabilities pose security risks if misconfigured.



Website . Github . Instagram . youtube . pypi . docker . gitter . e-mail . sponsor

About

The BackDoor of WebHole gives you the power to control websites and apps built with PHP, Flask, Django, and Go using the HTTP/HTTPS protocol. By sending files, tokens, and commands via POST/GET on port 80 or 443, users can perform tasks like editing, executing, or downloading files.

Resources

Stars

Watchers

Forks

Packages

No packages published

Contributors 2

  •  
  •