Web Sites/ Information systems are frequently exposed to code originating from various, possibly unknown/ un-trusted sources. This may include but not limited to hackers uploading malicious contents such as web shells on vulnerable sites. Comprises Data Security, Application and Web Infrastructure Audit About Webshell Typically, web shell is a sophisticated piece of code or program capable of traversing areas of File system of host server, gathering information thru reading code and critical information, Spying on Event Logs, open ports, processes etc. The shell gives the creator/user the ability to create, edit, delete or download any file of choice, to gain root access to server. The following is a snapshot of such webshells. Affected server are exploited where script owners try to access information saved on this systems. Webshells are scripts written in the supported language of a target web server including PHP, Python, ASP.Net and Unix Shell Script etc. Web server are subjected to reconnaissance for identification of vulnerabilities that can be exploited leading to installation of the shell script. These are usually possible through public file upload pages and applications vulnerable to remote File inclusion/ Local File Include (LFI). Impact of webshells Depending on the sensitivity of the digital assets/services, their presence on the info/ transaction server, may mar the business image as the contents would be of doubtful origin. Detecting Web Shells Site owners/admin can detect the presence of shell on their host web server system either by noticing of unusual timestamps, presence of suspicious files in internet available locations. The following snapshot shows the presence of webshells in a file uploads directory. These may go undetected as the names are as per the accepted pattern. Block Web Shell Protection against web shells include, mitigation of web application vulnerabilities. Securing Web server configuration weaknesses including for ex: in case of php, disabling functions such as exec (), shell_exec (), eval () in php.ini makes it hard to execute php based webshell. Web Applications with file upload features should be thoroughly tested. Conclusion: It then is the responsibility of all stakeholders to avoid such occasions by proactively contributing to information assurance by complying with security policies and procedures, and periodic monitoring and reporting any suspicious activity or content such as webshells in their respective digital assets and frontiers (web sites/applications).