Execution Modes
DSP supports two execution providers: local and webshell.
Local execution
Use local mode when the DSP host itself can reach the authorized target network.
Local execution flows through LocalExecutionProvider and the standard RunManager, then writes events, validation results, reports, and evidence packages to the local run directory.
Webshell execution
Use webshell mode when the POC requires activity to originate from an authorized remote host inside the target environment.
DSP dispatches scenario execution to the remote host, retrieves the resulting events.jsonl bundle, imports those events into the local Event Store, and continues through the same validation/report/evidence pipeline.
Webshell family status
Do not describe ASPX as production-ready. The current release documentation explicitly lists the Windows/IIS webshell path as unvalidated and Linux-oriented bundle handling as a known limitation.
Webshell configuration
The three main fields are:
- Family —
jsp, php, or aspx
- URL — full HTTP(S) path to the authorized endpoint
- Remote work directory — writable location used for remote scripts and event bundles
Examples:
The URL extension should match the selected family.
TLS verification
The CLI supports:
Use it when the webshell endpoint is HTTPS and certificate verification should be enforced.
Fake JSP lab
The source repository includes scripts/setup_fake_shelljsp_lab.sh for a quick isolated smoke test. It creates a small Flask endpoint that mimics the command interface used by a JSP webshell.
The fake shell endpoint can execute arbitrary shell commands. Use it only on an isolated test system and never expose it to the public Internet.
