LAB 646 – Response: Detecting a JSP Backdoor (NEW)

Course Overview

A JSP web shell backdoor provides attackers persistent control over compromised servers, enabling privilege escalation and lateral movement to other systems. Aligned with MITRE ATT&CK T1505.00, this lab provides hands-on experience detecting JSP backdoors in Java applications, analyzing compromise scope, and removing persistence while preserving evidence for investigation.

By the end of this skill lab, learners will be able to:

• Identify indicators of JSP web shells
• Analyze potential lateral movement and privilege escalation
• Remove persistence mechanisms securely