Unverified50% confidenceFactExact time
Mandiant described the paired use of the WHIPSHOT and SLAPSHOT tools: WHIPSHOT is a PHP WebShell that hides Base64-encoded C2 payloads in native HTTP headers, and SLAPSHOT is a Python tunneling tool that proxies traffic into the internal network.
1
Sources
50%
Confidence
Long-term
Relevance
10/16/2026
First Seen
Sources
Related Entities
Related Claims
Unverifiedwebhook.py is a server based on the standard-library ThreadingHTTPServer with five routes in total, including GET /webhook (Meta verification handshake), POST /webhook (parsing Meta's nested payload and replying via Graph API v19.0, printing a [DRY-RUN] log when credentials are not configured), and POST /twilio (receiving form-encoded TwiML), among others.58% similarUnverifiedA WebShell is essentially a script that can remotely execute system commands via HTTP requests, commonly in the form of PHP, ASP, or JSP files.55% similarUnverifiedSnapdrop和PairDrop均采用Node.js + WebSocket作为信令服务器54% similarUnverifiedWebhooks and Git hooks are bound to paths and credentials, not to the specific identity of the caller.54% similarVerifiedA webhook is essentially an HTTP callback: after a repository detects an event such as a code push, it sends a POST request to a pre-configured URL.52% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1045842API
curl https://kongchang.com/api/v1/knowledge/claims/1045842MCP
get_claim(id=1045842)