Glossary
China Chopper
A long-known, very small client-driven web shell model in which a tiny server-side file evaluates code sent by a dedicated client.
China Chopper is a web shell family publicly documented since the early 2010s. Its server component is famously tiny — often a single line in ASPX or PHP — that evaluates code sent in each request, while all of the functionality (file management, command execution, database access) lives in a separate client application.
Variants were widely observed in the 2021 Exchange ProxyLogon compromises. For defenders, China Chopper illustrates why reading a file's source is not enough: a tiny loader carries no visible capability at rest, so detection must rely on behaviour, context and file-integrity anomalies.