What Is a Bind Shell?
On this page
A bind shell opens a listening port on a compromised host and waits for the attacker to connect in. It is the conceptual opposite of a reverse shell: here the victim listens and the attacker initiates. Understanding both clarifies why network direction — who connects to whom — is so central to both attack and defense.
How does a bind shell work?#
After compromising a host, the attacker’s payload starts a service that listens on a chosen port and hands any connection an interactive shell:
- The payload binds a shell to, say, TCP port 4444 on the victim.
- The attacker connects to
victim_ip:4444from outside. - They get an interactive shell on the target.
The catch is step 2: the attacker must be able to reach that port. On a real network, an inbound firewall or NAT usually blocks unsolicited inbound connections — which is exactly why bind shells are less reliable in practice.
Bind vs reverse shell#
| Bind shell | Reverse shell | |
|---|---|---|
| Who listens | The victim | The attacker |
| Who connects | The attacker (inbound) | The victim (outbound) |
| Blocked by | Inbound firewall / NAT | Egress filtering |
| Real-world reliability | Lower | Higher |
Because inbound is commonly blocked and outbound commonly allowed, attackers reach for reverse shells far more often — but a bind shell can be the right tool when the attacker already sits on the internal network.
Bind shells round out the post-exploitation picture alongside reverse shells. More at the Network Security hub.
Frequently asked questions#
What is a bind shell?
A bind shell opens a listening port on the compromised target and waits for the attacker to connect to it. The attacker initiates the connection inbound. It is the conceptual opposite of a reverse shell, and it works only when the attacker can actually reach that listening port — which inbound firewalls often prevent.
Why are reverse shells more common than bind shells?
Because inbound connections are usually blocked. A bind shell needs the attacker to reach a port on the victim, which fails behind NAT or a firewall that drops unsolicited inbound traffic. A reverse shell has the victim connect outbound instead, which typical firewall rules allow — making it far more reliable in real environments.