Search
Search the blog.
What Is a Reverse Shell? A Practical Guide for Authorized Testing
A plain-English explanation of how reverse shells work, why they beat bind shells through firewalls, and how a reverse shell generator saves you from copy-paste mistakes.
Bash Reverse Shell One-Liners: How /dev/tcp Actually Works
The common bash reverse shell one-liners explained line by line, why they need bash (not sh), and how to fall back when /dev/tcp is missing.
Python Reverse Shell: One-Liners That Survive python vs python3
How the python reverse shell one-liner works with socket and pty, why the python/python3 split breaks payloads, and a version-agnostic fallback.
Netcat Reverse Shell: When -e Is Missing and What to Do
How the netcat reverse shell works, why most modern nc builds dropped the -e flag, and the mkfifo and ncat alternatives that replace it.
PHP Reverse Shell: From One-Liner to disable_functions
How a PHP reverse shell works on a compromised web app, the fsockopen and proc_open variants, and what to do when exec is disabled.
Windows Reverse Shell: PowerShell, nc.exe, and a Real TTY
How reverse shells work on Windows targets, the PowerShell TCPClient one-liner versus dropping nc.exe, and how to get an interactive console.
Reverse Shell Cheat Sheet: One-Liners, Listener, and Upgrade
A quick-reference reverse shell cheat sheet — bash, python, php, powershell and netcat one-liners, the listener to catch them, and the TTY upgrade — with links to the full guide for each.
msfvenom Reverse Shell: Staged vs Stageless and the Listener Trap
How to generate a reverse shell with msfvenom, the difference between staged and stageless payloads, and why your nc listener catches one but not the other.
Socat Reverse Shell: A Fully Interactive TTY Without the stty Dance
How a socat reverse shell gives you a fully interactive PTY out of the box, plus the encrypted OPENSSL variant — when socat is available on the target.
Bind Shell vs Reverse Shell: Which One and Why
The difference between a bind shell and a reverse shell, why reverse shells win through firewalls and NAT, and the cases where a bind shell is still the right call.
From LFI to Reverse Shell: Log Poisoning and PHP Wrappers
How a Local File Inclusion becomes code execution and then a reverse shell — via log poisoning, PHP session files, and php:// wrappers — in authorized web testing.
Staged vs Stageless Payloads: What the Slash in the Name Means
The difference between staged and stageless reverse shell payloads, why it changes which listener you need, and how to choose between them.
Egress Filtering and Reverse Shells: Why Port 443 Wins
How outbound firewall rules decide whether a reverse shell connects, how to test egress before you fire, and why 443 and 80 are the default ports.
Using a Reverse Shell Generator Without Turning Your Lab Into a Mess
A practical workflow for generating reverse shell snippets in authorized labs, with sane listener setup, network checks, and failure triage.
Ruby Reverse Shell: One-Liners for Boxes That Run Rails
How a ruby reverse shell works with the socket library, the common one-liners, and when Ruby is the interpreter you can count on.
Perl Reverse Shell: The One-Liner That Works on Ancient Boxes
How the perl reverse shell works with the Socket module, the classic one-liner, and why Perl is the fallback on legacy Unix systems.
Why Reverse Shells Fail: The Boring Network Bugs Behind Most Dead Callbacks
Reverse shells usually fail because of routing, egress filtering, listeners, quoting, or missing runtimes. Here is how to debug them cleanly.
Detecting Reverse Shells Without Pretending One Sigma Rule Is Enough
Reverse shell detection needs process, network, and context. Single-rule matching misses quiet callbacks and floods teams with false positives.
Webshell vs Reverse Shell: Foothold vs Interactive Session
The difference between a webshell and a reverse shell, why testers often use both, and how each one looks to a defender.
Choosing a Reverse Shell Listener: Netcat Is Fine Until It Is Not
How to pick a listener for authorized reverse shell testing, from netcat to ncat and socat, without overbuilding the lab.
Node.js Reverse Shell: child_process Meets net.Socket
How a Node.js reverse shell works by piping a spawned shell through a TCP socket, the one-liner, and when Node is the interpreter you can rely on.
Java Reverse Shell: Runtime.exec and the App-Server Context
How a Java reverse shell works via Runtime.exec wrapping a bash payload, the pure-socket alternative, and why it shows up in JSP and deserialization bugs.
Upgrading A Reverse Shell Is About Terminal Control, Not Flexing Tricks
Reverse shell upgrades fix PTY, signals, line editing, and job control. Here is what matters in authorized testing.
AWK Reverse Shell: The Fallback When Nothing Else Is Installed
How a gawk reverse shell uses the /inet/tcp special file, the one-liner, and why it only works with GNU awk — a true last-resort payload.
Reverse Shell Payload Quoting: The Part That Breaks In JSON, YAML, And Web Forms
Why reverse shell commands break when they pass through parsers, wrappers, CI variables, and web inputs.
PowerShell Reverse Shells: Useful In Labs, Noisy In Real Windows Environments
PowerShell reverse shell testing comes with execution policy, logging, AMSI, quoting, and noisy process telemetry.
Reverse SSH Tunnel: A Stable Alternative to a Raw Reverse Shell
When you have SSH access, a reverse SSH tunnel (ssh -R) gives a stable, encrypted, fully interactive session — and a way to pivot — that beats a fragile netcat shell.
Groovy Reverse Shell: The Jenkins Script Console Classic
How a Groovy reverse shell works on the JVM, the one used against the Jenkins script console, and where else Groovy execution shows up.
Reverse Shells In Containers: The Network Namespace Is The Trap
Container reverse shell testing fails when operators forget network namespaces, minimal images, missing tools, and Kubernetes policy.
Reverse Shell Lab Cleanup: The Part People Skip Until Evidence Gets Messy
Authorized reverse shell testing should leave clean notes, stopped listeners, known artifacts, and logs that make sense later.
macOS Reverse Shell: zsh, an Old Bash, and Maybe No Python
How reverse shells work on macOS targets — which interpreters ship, why the default shell is zsh, and the SIP/TCC realities of authorized Mac testing.
PowerShell -EncodedCommand: Why Base64, and the UTF-16 Gotcha
How PowerShell -EncodedCommand works, why testers base64-encode reverse shell payloads to dodge quoting, and the UTF-16LE encoding mistake that breaks it.
Picking The Right Reverse Shell Payload Is Mostly About The Target Runtime
Payload choice should follow target runtime, shell availability, egress path, quoting context, and evidence needs.
The Reverse Shell Workflow for OSCP and CTFs
A repeatable reverse shell workflow for exams and CTFs: listener first, enumerate interpreters, pick the payload, catch on 443, upgrade the TTY, and note it for the report.