What Is a Reverse Shell?
A reverse shell flips the usual direction of a remote connection: instead of the attacker connecting in to the victim, the compromised host connects out to the attacker. That simple inversion sidesteps the perimeter, because firewalls usually block inbound connections while allowing outbound ones. It is one of the most common ways attackers get interactive control after an initial compromise.
Why do attackers prefer reverse shells?#
Because of how firewalls are typically configured:
| Bind shell (attacker connects in) | Reverse shell (victim connects out) | |
|---|---|---|
| Direction | Inbound to victim | Outbound from victim |
| Blocked by | Inbound firewall rules (common) | Egress rules (often permissive) |
| Reliability behind NAT/firewall | Poor | Good |
Most networks tightly restrict what can connect in but let hosts connect out freely. A reverse shell exploits that asymmetry — the victim “calls home” to the attacker’s listener, establishing the command-and-control channel of the Cyber Kill Chain.
How do you detect and prevent them?#
The defense lives on the way out:
- Egress filtering — allow only necessary outbound connections; a database server should not be dialing the internet. See egress filtering.
- Egress monitoring — alert on unexpected outbound connections, odd ports, and unknown destinations.
- Endpoint detection — flag shell processes (like
bashorcmd) opening network sockets.
Reverse shells are core post-exploitation, the counterpart to bind shells. More at the Network Security hub.
Frequently asked questions#
What is a reverse shell?
A reverse shell is a remote shell where the compromised target initiates the connection back to the attacker, rather than the attacker connecting in. Because most firewalls block inbound connections but allow outbound ones, having the victim "call home" sidesteps the perimeter — which is why reverse shells are a staple of post-exploitation.
How do you detect and prevent reverse shells?
Detect them through egress monitoring: unexpected outbound connections, especially to unusual ports or addresses, from a server that should not initiate them. Prevent them with strict egress filtering that allows only necessary outbound traffic, plus endpoint detection that spots shell processes making network connections.