Detecting Behinder and Godzilla: Encrypted Web Shell Traffic

Behinder and Godzilla are Java-based clients that talk to small server-side stubs and encrypt each request and response, usually with AES. That defeats simple content rules, but both ship with default keys, passwords and client behaviours, and both leave distinctive patterns in headers, cookies and response structure. Public analyses document these defaults; operators who do not change them are easy to find.

Signals at a Glance

Default Traffic Characteristics

Both frameworks are written in Java, so earlier client versions send the Java default Accept header (text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2) unless the operator overrides it. Behinder uses an application/octet-stream style body for its encrypted requests; Godzilla responses commonly wrap a base64 blob between fixed-length hash fragments. Treat these as hunting leads and tune them to your own web traffic.

alert http $EXTERNAL_NET any -> $HOME_NET any (
  msg:"HUNT Java default Accept on POST with octet-stream body (encrypted web shell client)";
  flow:established,to_server;
  http.method; content:"POST";
  http.header; content:"Accept|3a| text/html, image/gif, image/jpeg, *|3b| q=.2, */*|3b| q=.2|0d 0a|";
  content:"Content-Type|3a| application/octet-stream";
  threshold:type limit, track by_src, count 1, seconds 3600;
  classtype:web-application-attack; sid:1000701; rev:1;
)
# Tune/validate: legitimate Java clients and API integrations also send this Accept header.
# Restrict $HOME_NET destinations to servers that do not normally receive Java client traffic.

Default keys are the other half. A server stub for Behinder embeds the AES key, which for a default install is the first 16 hex characters of the MD5 hash of the password rebeyond, e45e329feb5d925b. Godzilla ships with the default key 3c6e0b8a9c15224a. Scanning web roots for either string is cheap and will find careless deployments.

Host Signals That Survive Encryption

index=web sourcetype=access_combined method=POST
| eval is_octet=if(like(content_type, "application/octet-stream"), 1, 0)
| stats count as reqs dc(clientip) as clients avg(bytes) as avg_bytes
        stdev(bytes) as sd_bytes max(is_octet) as octet by uri_path
| where reqs > 50 AND clients <= 3 AND octet=1
| eval bytes_cv = if(avg_bytes>0, sd_bytes/avg_bytes, null())
| sort - reqs
# Tune/validate: field names depend on your web log parser and content-type extraction.

• Child processes remain the strongest signal. Whatever the transport, a command run through the shell appears as a web server child process.
• Scan web roots for the default key strings above and for stubs that call AES decrypt followed by a reflective class-load or eval.
• Look for long-lived, regular sessions from a single client to one script URI. Interactive use produces bursts, and automated tasking produces a rhythm.
• Inspect TLS-terminated traffic at the reverse proxy or WAF rather than at the perimeter. The inspection point decides whether you can see headers at all.