using network monitoring tools such as wireshark, an attacker can find vulnerabilities which are exploited resulting in a web shell installation. these vulnerabilities may be present in content management system applications or the web server's software.