Skip to main content

​
Execution Modes

DSP supports two execution providers: local and webshell.

​
Local execution

Use local mode when the DSP host itself can reach the authorized target network.
Local execution uses LocalExecutionProvider and RunManager, then writes events, validation results, reports, and verification files to the local run directory.

​
Webshell execution

Use webshell mode when the POC requires activity to originate from an authorized remote host inside the target environment.
DSP dispatches scenario execution to the remote host, retrieves the resulting events.jsonl bundle, imports those events into the local Event Store, and continues through the same validation and reporting process.

​
Webshell family status

Do not describe ASPX as production-ready. The current release documentation lists the Windows/IIS webshell path as unvalidated and notes that the validated bundle-handling path is Linux-oriented.

​
Webshell configuration

The three main fields are:
  • Family — jsp, php, or aspx
  • URL — full HTTP(S) path to the authorized endpoint
  • Remote work directory — writable location used for remote scripts and event bundles
Examples:
The URL extension should match the selected family.

​
TLS verification

The CLI supports:
Use it when the webshell endpoint is HTTPS and certificate verification should be enforced.

​
Fake JSP lab

The source repository includes scripts/setup_fake_shelljsp_lab.sh for a quick isolated smoke test. It creates a small Flask endpoint that mimics the command interface used by a JSP webshell.
The fake shell endpoint can execute arbitrary shell commands. Use it only on an isolated test system and never expose it to the public Internet.
For production-like remote validation, use a properly controlled JSP/Tomcat or PHP/Apache test environment rather than the fake lab endpoint.