What Is a Reverse Shell? A Practical Guide for Authorized Testing

A reverse shell is a command-line session that the target opens back to you. Instead of you connecting in to a port the target is listening on, the target reaches out to a listener you control and hands you a shell on arrival. It is the single most common post-exploitation primitive in authorized penetration testing, and it exists for one stubborn reason: outbound connections survive firewalls that kill inbound ones.

This guide explains what actually happens on the wire, when to reach for a reverse shell versus a bind shell, and why a reverse shell generator is worth using even once you understand the mechanics by heart.

Bind Shell vs. Reverse Shell

The two differ only in who initiates the connection.

A bind shell makes the target listen on a port and wait. You connect to it. That works on a flat lab network and almost nowhere else, because perimeter firewalls and NAT routinely drop unsolicited inbound traffic to a host.

A reverse shell flips the direction. You run a listener; the target connects out to it. Egress filtering is usually far looser than ingress filtering — outbound 443 and 80 are open on nearly every network because users need the web — so the target's call home tends to get through.

That asymmetry is the whole point. In a real engagement you rarely control the target's inbound rules, but you almost always have a box on the internet that can listen.

What Happens Step by Step

You start a listener on a host you control, e.g. nc -lvnp 443.
You get code execution on the target and run a one-liner that connects back to your LHOST:LPORT.
The one-liner wires the socket to a shell's standard input, output, and error.
Your listener now receives the shell's output and sends it keystrokes. You have an interactive session.

The "wire the socket to a shell" part is what every payload does, just expressed differently per language and platform. A bash payload uses /dev/tcp; a python payload uses the socket and subprocess modules; a PowerShell payload uses System.Net.Sockets.TCPClient. Same idea, different plumbing.

Why Payloads Break (and Why a Generator Helps)

Reverse shell one-liners are deceptively fragile. The same command fails or succeeds depending on details that have nothing to do with the concept:

The wrong interpreter. /dev/tcp is a bash feature. Paste a bash one-liner into /bin/sh (often dash) and it silently fails.
Quoting. The payload passes through a web form, JSON body, or CI variable before it reaches a shell, and each layer eats or mangles a quote. (We cover this in depth in payload quoting.)
A missing binary. You sent a python payload to a host that only has python3, or an nc payload to a netcat build compiled without -e.
A typo in LHOST/LPORT. The most common failure of all, and the most embarrassing.

A reverse shell generator removes the avoidable failures. You set your LHOST and LPORT once, pick the target's shell and platform, and get a payload that is consistently quoted, with the matching listener command beside it. That last part matters more than people expect — half of failed shells are a mismatch between the payload and the listener, not a bug in either one. (See choosing a listener.)

It is not about not knowing the syntax. It is about not retyping it under time pressure and getting a quote wrong on the fifth attempt.

A Shell Is Not a Good Shell Yet

When the connection lands, you usually get a raw, non-interactive shell: no job control, no tab completion, no Ctrl-C without killing the session, no sudo prompt that behaves. That is normal. The next move is to upgrade it to a full TTY (typically via python3 -c 'import pty; pty.spawn("/bin/bash")' and stty tricks), which we walk through in upgrading a reverse shell.

Use This Only Where You Are Authorized

Everything here is for security testing you are explicitly authorized to perform — your own lab, a CTF, or an engagement with a signed scope. Reverse shells are dual-use by nature; the technique is identical whether the work is sanctioned or not, and only the authorization makes it legitimate. Generate payloads against systems you own or have written permission to test, and nothing else.

Where to Go Next

Build a payload now with the reverse shell generator.
Language-specific deep dives: bash reverse shells, python reverse shells, PowerShell reverse shells.
When it does not connect: why reverse shells fail.