tencent cloud

APIs

DocumentationAPIsCloud Workload Protection PlatformVirus Scanning APIsDescribeJavaMemShellList

DescribeJavaMemShellList

Download
Focus Mode
Font Size
Last updated: 2026-06-08 10:20:04

1. API Description

Domain name for API request: cwp.intl.tencentcloudapi.com.

This API is used to query the list of Java webshell events.

A maximum of 20 requests can be initiated per second for this API.

We recommend you to use API Explorer
Try it
API Explorer provides a range of capabilities, including online call, signature authentication, SDK code generation, and API quick search. It enables you to view the request, response, and auto-generated examples.

2. Input Parameters

The following request parameter list only provides API request parameters and some common parameters. For the complete common parameter list, see Common Request Parameters.

Parameter Name Required Type Description
Action Yes String Common Params. The value used for this API: DescribeJavaMemShellList.
Version Yes String Common Params. The value used for this API: 2018-02-28.
Region No String Common Params. This parameter is not required.
Filters.N No Array of Filters Filtering criteria: InstanceID and IP

MachineName host name for fuzzy query; Type, status for precise match; CreateBeginTime, CreateEndTime for time period
Offset No Integer Offset, which defaults to 0
Limit No Integer Number of items to be returned. It is 10 by default, and the maximum value is 100.
Order No String Sorting method (case insensitive): asc for ascending order; desc for descending order
By No String Sort column, strictly equal: Latest detection time RecentFoundTime

3. Output Parameters

Parameter Name Type Description
List Array of JavaMemShellInfo Event list
TotalCount Integer Total number
RequestId String The unique request ID, generated by the server, will be returned for every request (if the request fails to reach the server for other reasons, the request will not obtain a RequestId). RequestId is required for locating a problem.

4. Example

Example1 Querying a List of Java Webshell Events

Querying a List of Java Webshell Events

Input Example

POST / HTTP/1.1
Host: cwp.intl.tencentcloudapi.com
Content-Type: application/json
X-TC-Action: DescribeJavaMemShellList
<Common request parameters>

{
    "Offset": 1,
    "Limit": 1
}

Output Example

{
    "Response": {
        "List": [
            {
                "Id": 184113,
                "Quuid": "d4cc302e-09e5-436f-b99b-5ab9c9070323",
                "Uuid": "d4cc302e-09e5-436f-b99b-5ab9c9070323",
                "Alias": "machine",
                "HostIp": "1.1.1.1",
                "Type": 0,
"Description": "A Trojan has been detected in the webshell_filter class loaded in the java process 921852/org.apache.catalina.startup.Bootstrap start."
                "CreateTime": "2024-09-20 15:32:08",
                "RecentFoundTime": "2024-09-20 15:32:08",
                "Status": 1,
                "MachineExtraInfo": {
                    "WanIP": "1.1.1.1",
                    "PrivateIP": "1.1.1.1",
                    "NetworkType": 0,
                    "NetworkName": "vpc-id",
                    "InstanceID": "ins-id",
                    "HostName": "hn"
                },
                "ClassName": "webshell_filter",
                "SuperClassName": "java.my.******",
                "Interfaces": "javax\\.servlet\\.Filter",
                "Annotations": "anno",
                "LoaderClassName": "org\\.apache\\.jsp\\.bebinder_005fshell_jsp\\$U"
            }
        ],
        "RequestId": "bf4896f8-84ba-405d-bbc9-b4d951f52161",
        "TotalCount": 1
    }
}

Example2 This example shows you how to view the list of Java webshell injection events.

This example shows you how to view the list of Java webshell injection events.

Input Example

POST / HTTP/1.1
Host: cwp.intl.tencentcloudapi.com
Content-Type: application/json
X-TC-Action: DescribeJavaMemShellList
<Common request parameters>

{}

Output Example

{
    "Response": {
        "List": [
            {
"Alias": "Memory shell injection",
                "Annotations": "",
                "ClassName": "org\\.apache\\.jsp\\.test_jsp",
                "CreateTime": "2025-06-22 14:36:54",
"Description": "Detected Trojan in org.apache.jsp.test_jsp class loaded by java process 1229492/org.apache.catalina.startup.Bootstrap start"
                "HostIp": "129.226.165.240",
                "Id": 163073,
                "Interfaces": "org\\.apache\\.jasper\\.runtime\\.JspSourceImports\\|javax\\.servlet\\.ServletConfig\\|javax\\.servlet\\.Servlet\\|org\\.apache\\.jasper\\.runtime\\.JspSourceDependent\\|javax\\.servlet\\.jsp\\.HttpJspPage\\|java\\.io\\.Serializable",
                "LoaderClassName": "",
                "MachineExtraInfo": {
                    "HostName": "",
                    "InstanceID": "ins-7hg2g94e",
                    "NetworkName": "",
                    "NetworkType": 0,
                    "PrivateIP": "172.19.0.14",
                    "WanIP": "129.226.165.240"
                },
                "Quuid": "421c0ff7-84ce-4f41-b015-9329748e90d9",
                "RecentFoundTime": "2025-06-22 14:36:54",
                "Status": 1,
                "SuperClassName": "org\\.apache\\.jasper\\.runtime\\.HttpJspBase\\|javax\\.servlet\\.http\\.HttpServlet\\|javax\\.servlet\\.GenericServlet",
                "Type": 2,
                "Uuid": "421c0ff7-84ce-4f41-b015-9329748e90d9"
            },
            {
"Alias": "Memory shell injection",
                "Annotations": "",
                "ClassName": "org\\.apache\\.jsp\\.test_jsp",
                "CreateTime": "2025-06-22 12:17:02",
"Description": "Detected a Trojan in the org.apache.jsp.test_jsp class loaded by java process 1185744/org.apache.catalina.startup.Bootstrap start"
                "HostIp": "129.226.165.240",
                "Id": 163072,
                "Interfaces": "org\\.apache\\.jasper\\.runtime\\.JspSourceImports\\|javax\\.servlet\\.ServletConfig\\|javax\\.servlet\\.Servlet\\|org\\.apache\\.jasper\\.runtime\\.JspSourceDependent\\|javax\\.servlet\\.jsp\\.HttpJspPage\\|java\\.io\\.Serializable",
                "LoaderClassName": "",
                "MachineExtraInfo": {
                    "HostName": "",
                    "InstanceID": "ins-7hg2g94e",
                    "NetworkName": "",
                    "NetworkType": 0,
                    "PrivateIP": "172.19.0.14",
                    "WanIP": "129.226.165.240"
                },
                "Quuid": "421c0ff7-84ce-4f41-b015-9329748e90d9",
                "RecentFoundTime": "2025-06-22 12:17:02",
                "Status": 1,
                "SuperClassName": "org\\.apache\\.jasper\\.runtime\\.HttpJspBase\\|javax\\.servlet\\.http\\.HttpServlet\\|javax\\.servlet\\.GenericServlet",
                "Type": 2,
                "Uuid": "421c0ff7-84ce-4f41-b015-9329748e90d9"
            },
            {
"Alias": "Memory shell injection",
                "Annotations": "",
                "ClassName": "org\\.apache\\.jsp\\.test_jsp",
                "CreateTime": "2025-06-21 17:40:02",
"Description": "Detected Trojan in org.apache.jsp.test_jsp class loaded by java process 843518/org.apache.catalina.startup.Bootstrap start"
                "HostIp": "129.226.165.240",
                "Id": 163071,
                "Interfaces": "org\\.apache\\.jasper\\.runtime\\.JspSourceImports\\|javax\\.servlet\\.ServletConfig\\|javax\\.servlet\\.Servlet\\|org\\.apache\\.jasper\\.runtime\\.JspSourceDependent\\|javax\\.servlet\\.jsp\\.HttpJspPage\\|java\\.io\\.Serializable",
                "LoaderClassName": "",
                "MachineExtraInfo": {
                    "HostName": "",
                    "InstanceID": "ins-7hg2g94e",
                    "NetworkName": "",
                    "NetworkType": 0,
                    "PrivateIP": "172.19.0.14",
                    "WanIP": "129.226.165.240"
                },
                "Quuid": "421c0ff7-84ce-4f41-b015-9329748e90d9",
                "RecentFoundTime": "2025-06-21 17:40:02",
                "Status": 1,
                "SuperClassName": "org\\.apache\\.jasper\\.runtime\\.HttpJspBase\\|javax\\.servlet\\.http\\.HttpServlet\\|javax\\.servlet\\.GenericServlet",
                "Type": 2,
                "Uuid": "421c0ff7-84ce-4f41-b015-9329748e90d9"
            },
            {
"Alias": "Memory shell injection",
                "Annotations": "",
                "ClassName": "org\\.apache\\.jsp\\.test_jsp",
                "CreateTime": "2025-06-21 16:16:00",
"Description": "Detected Trojan in the org.apache.jsp.test_jsp class loaded by java process 816313/org.apache.catalina.startup.Bootstrap start"
                "HostIp": "129.226.165.240",
                "Id": 163070,
                "Interfaces": "org\\.apache\\.jasper\\.runtime\\.JspSourceImports\\|javax\\.servlet\\.ServletConfig\\|javax\\.servlet\\.Servlet\\|org\\.apache\\.jasper\\.runtime\\.JspSourceDependent\\|javax\\.servlet\\.jsp\\.HttpJspPage\\|java\\.io\\.Serializable",
                "LoaderClassName": "",
                "MachineExtraInfo": {
                    "HostName": "",
                    "InstanceID": "ins-7hg2g94e",
                    "NetworkName": "",
                    "NetworkType": 0,
                    "PrivateIP": "172.19.0.14",
                    "WanIP": "129.226.165.240"
                },
                "Quuid": "421c0ff7-84ce-4f41-b015-9329748e90d9",
                "RecentFoundTime": "2025-06-21 16:16:00",
                "Status": 1,
                "SuperClassName": "org\\.apache\\.jasper\\.runtime\\.HttpJspBase\\|javax\\.servlet\\.http\\.HttpServlet\\|javax\\.servlet\\.GenericServlet",
                "Type": 2,
                "Uuid": "421c0ff7-84ce-4f41-b015-9329748e90d9"
            },
            {
"Alias": "Memory shell injection",
                "Annotations": "",
                "ClassName": "org\\.apache\\.jsp\\.test_jsp",
                "CreateTime": "2025-06-21 16:11:43",
"Description": "Detected a Trojan in the org.apache.jsp.test_jsp class loaded by the java process 814511/org.apache.catalina.startup.Bootstrap start"
                "HostIp": "129.226.165.240",
                "Id": 163069,
                "Interfaces": "org\\.apache\\.jasper\\.runtime\\.JspSourceImports\\|javax\\.servlet\\.ServletConfig\\|javax\\.servlet\\.Servlet\\|org\\.apache\\.jasper\\.runtime\\.JspSourceDependent\\|javax\\.servlet\\.jsp\\.HttpJspPage\\|java\\.io\\.Serializable",
                "LoaderClassName": "",
                "MachineExtraInfo": {
                    "HostName": "",
                    "InstanceID": "ins-7hg2g94e",
                    "NetworkName": "",
                    "NetworkType": 0,
                    "PrivateIP": "172.19.0.14",
                    "WanIP": "129.226.165.240"
                },
                "Quuid": "421c0ff7-84ce-4f41-b015-9329748e90d9",
                "RecentFoundTime": "2025-06-21 16:11:43",
                "Status": 1,
                "SuperClassName": "org\\.apache\\.jasper\\.runtime\\.HttpJspBase\\|javax\\.servlet\\.http\\.HttpServlet\\|javax\\.servlet\\.GenericServlet",
                "Type": 2,
                "Uuid": "421c0ff7-84ce-4f41-b015-9329748e90d9"
            },
            {
"Alias": "Memory shell injection",
                "Annotations": "",
                "ClassName": "org\\.apache\\.jsp\\.test_jsp",
                "CreateTime": "2025-06-21 16:07:50",
"Description": "Detected Trojan in org.apache.jsp.test_jsp class loaded by java process 813379/org.apache.catalina.startup.Bootstrap start"
                "HostIp": "129.226.165.240",
                "Id": 163068,
                "Interfaces": "org\\.apache\\.jasper\\.runtime\\.JspSourceImports\\|javax\\.servlet\\.ServletConfig\\|javax\\.servlet\\.Servlet\\|org\\.apache\\.jasper\\.runtime\\.JspSourceDependent\\|javax\\.servlet\\.jsp\\.HttpJspPage\\|java\\.io\\.Serializable",
                "LoaderClassName": "",
                "MachineExtraInfo": {
                    "HostName": "",
                    "InstanceID": "ins-7hg2g94e",
                    "NetworkName": "",
                    "NetworkType": 0,
                    "PrivateIP": "172.19.0.14",
                    "WanIP": "129.226.165.240"
                },
                "Quuid": "421c0ff7-84ce-4f41-b015-9329748e90d9",
                "RecentFoundTime": "2025-06-21 16:07:50",
                "Status": 1,
                "SuperClassName": "org\\.apache\\.jasper\\.runtime\\.HttpJspBase\\|javax\\.servlet\\.http\\.HttpServlet\\|javax\\.servlet\\.GenericServlet",
                "Type": 2,
                "Uuid": "421c0ff7-84ce-4f41-b015-9329748e90d9"
            },
            {
"Alias": "Memory shell injection",
                "Annotations": "",
                "ClassName": "org\\.apache\\.jsp\\.test_jsp",
                "CreateTime": "2025-06-21 16:02:50",
"Description": "A Trojan was found in the org.apache.jsp.test_jsp class loaded by the detected java process 812553/org.apache.catalina.startup.Bootstrap start"
                "HostIp": "129.226.165.240",
                "Id": 163067,
                "Interfaces": "org\\.apache\\.jasper\\.runtime\\.JspSourceImports\\|javax\\.servlet\\.ServletConfig\\|javax\\.servlet\\.Servlet\\|org\\.apache\\.jasper\\.runtime\\.JspSourceDependent\\|javax\\.servlet\\.jsp\\.HttpJspPage\\|java\\.io\\.Serializable",
                "LoaderClassName": "",
                "MachineExtraInfo": {
                    "HostName": "",
                    "InstanceID": "ins-7hg2g94e",
                    "NetworkName": "",
                    "NetworkType": 0,
                    "PrivateIP": "172.19.0.14",
                    "WanIP": "129.226.165.240"
                },
                "Quuid": "421c0ff7-84ce-4f41-b015-9329748e90d9",
                "RecentFoundTime": "2025-06-21 16:02:50",
                "Status": 1,
                "SuperClassName": "org\\.apache\\.jasper\\.runtime\\.HttpJspBase\\|javax\\.servlet\\.http\\.HttpServlet\\|javax\\.servlet\\.GenericServlet",
                "Type": 2,
                "Uuid": "421c0ff7-84ce-4f41-b015-9329748e90d9"
            },
            {
"Alias": "Memory shell injection",
                "Annotations": "",
                "ClassName": "org\\.apache\\.jsp\\.shell_005finject_jsp",
                "CreateTime": "2025-06-21 11:23:10",
"Description": "A Trojan has been detected in the org.apache.jsp.shell_005finject_jsp class loaded in the java process 499548/org.apache.catalina.startup.Bootstrap start."
                "HostIp": "129.226.165.240",
                "Id": 163065,
                "Interfaces": "org\\.apache\\.jasper\\.runtime\\.JspSourceImports\\|javax\\.servlet\\.ServletConfig\\|javax\\.servlet\\.Servlet\\|org\\.apache\\.jasper\\.runtime\\.JspSourceDependent\\|javax\\.servlet\\.jsp\\.HttpJspPage\\|java\\.io\\.Serializable",
                "LoaderClassName": "",
                "MachineExtraInfo": {
                    "HostName": "",
                    "InstanceID": "ins-7hg2g94e",
                    "NetworkName": "",
                    "NetworkType": 0,
                    "PrivateIP": "172.19.0.14",
                    "WanIP": "129.226.165.240"
                },
                "Quuid": "421c0ff7-84ce-4f41-b015-9329748e90d9",
                "RecentFoundTime": "2025-06-21 11:23:10",
                "Status": 0,
                "SuperClassName": "org\\.apache\\.jasper\\.runtime\\.HttpJspBase\\|javax\\.servlet\\.http\\.HttpServlet\\|javax\\.servlet\\.GenericServlet",
                "Type": 2,
                "Uuid": "421c0ff7-84ce-4f41-b015-9329748e90d9"
            },
            {
"Alias": "Memory shell injection",
                "Annotations": "",
                "ClassName": "org\\.apache\\.jsp\\.shell_005finject_jsp\\$MaliciousFilter",
                "CreateTime": "2025-06-21 11:23:10",
"Description": "A Trojan has been detected in the org.apache.jsp.shell_005finject_jsp$MaliciousFilter class loaded in the java process 499548/org.apache.catalina.startup.Bootstrap start."
                "HostIp": "129.226.165.240",
                "Id": 163064,
                "Interfaces": "javax\\.servlet\\.Filter",
                "LoaderClassName": "",
                "MachineExtraInfo": {
                    "HostName": "",
                    "InstanceID": "ins-7hg2g94e",
                    "NetworkName": "",
                    "NetworkType": 0,
                    "PrivateIP": "172.19.0.14",
                    "WanIP": "129.226.165.240"
                },
                "Quuid": "421c0ff7-84ce-4f41-b015-9329748e90d9",
                "RecentFoundTime": "2025-06-21 11:23:10",
                "Status": 0,
                "SuperClassName": "",
                "Type": 0,
                "Uuid": "421c0ff7-84ce-4f41-b015-9329748e90d9"
            },
            {
"Alias": "Memory shell injection",
                "Annotations": "",
                "ClassName": "org\\.apache\\.jsp\\.test_jsp",
                "CreateTime": "2025-06-20 23:15:41",
"Description": "Detected Trojan in the org.apache.jsp.test_jsp class loaded by java process 499548/org.apache.catalina.startup.Bootstrap start"
                "HostIp": "129.226.165.240",
                "Id": 163063,
                "Interfaces": "org\\.apache\\.jasper\\.runtime\\.JspSourceImports\\|javax\\.servlet\\.ServletConfig\\|javax\\.servlet\\.Servlet\\|org\\.apache\\.jasper\\.runtime\\.JspSourceDependent\\|javax\\.servlet\\.jsp\\.HttpJspPage\\|java\\.io\\.Serializable",
                "LoaderClassName": "",
                "MachineExtraInfo": {
                    "HostName": "",
                    "InstanceID": "ins-7hg2g94e",
                    "NetworkName": "",
                    "NetworkType": 0,
                    "PrivateIP": "172.19.0.14",
                    "WanIP": "129.226.165.240"
                },
                "Quuid": "421c0ff7-84ce-4f41-b015-9329748e90d9",
                "RecentFoundTime": "2025-06-20 23:15:41",
                "Status": 1,
                "SuperClassName": "org\\.apache\\.jasper\\.runtime\\.HttpJspBase\\|javax\\.servlet\\.http\\.HttpServlet\\|javax\\.servlet\\.GenericServlet",
                "Type": 2,
                "Uuid": "421c0ff7-84ce-4f41-b015-9329748e90d9"
            }
        ],
        "RequestId": "95a7369c-672f-4737-a52c-1aaea420a920",
        "TotalCount": 62
    }
}

5. Developer Resources

SDK

TencentCloud API 3.0 integrates SDKs that support various programming languages to make it easier for you to call APIs.

Command Line Interface

6. Error Code

The following only lists the error codes related to the API business logic. For other error codes, see Common Error Codes.

Error Code Description
InternalError Internal error
InvalidParameter Incorrect parameter.
InvalidParameter.InvalidFormat Incorrect parameter format.
InvalidParameter.MissingParameter Missing parameter.
InvalidParameter.ParsingError Incorrect parameter parsing.
InvalidParameterValue Invalid parameter value.
MissingParameter Missing parameter error.
Previous Topic: DescribeVulDefenceOverviewNext Topic: ModifyJavaMemShellsStatus

Help and Support

Was this page helpful?

Help us improve! Rate your documentation experience in 5 mins.

Feedback