Hosting malicious payload on trusted web application

This procedure places a server-side web script on an openly accessible web server and accesses it through the web service to obtain execution under the server-side runtime. It assumes the operator already has authorized access or a compromised upload path; the upload endpoint, storage path, and script runtime are application-specific. It describes web-shell deployment and use, not ordinary third-party payload staging, phishing delivery, or client-side drive-by compromise.