Web shells are frequently used in website attacks. They can allow attackers to bypass web servers to access underlying operating systems or databases to steal the critical information, such as user credentials. Consequently, the operating systems can be compromised through web servers. To avoid the detection and code analysis, web shells often obfuscate their codes or add login functions to conceal their features and presence. This session will demonstrate a number of web shells and their obfuscation techniques.