A webshell is a page (typically a .php file) uploaded to a site by an attacker after a compromise (e.g. an RCE), which is then used by an attacker through their

A webshell is a page (typically a .php file) uploaded to a site by an attacker after a compromise (e.g. an RCE), which is then used by an attacker through their browser to perform further actions on the compromised webserver. These premade webshell files however have been made by other attackers and come pre-compromised with a backdoor. In this case the CSS in the webshell makes the attacker's browser snitch the webshell's location to a domain controlled by the author of the webshell.