Reverse shell
reverse connection · connect-back shell · callback shell · bind shell · shell inversé
Remote access in which the compromised machine calls the attacker itself, which lets it slip past firewalls that block incoming connections.
In practice
Many firewalls filter what comes in but let almost anything go out. After exploiting a flaw, the attacker therefore makes the server open an outgoing connection to a machine they control, often on an ordinary port such as the web’s, and gets a remote command line. A “bind shell”, less common, does the opposite: it opens a listening door on the victim. Either way, a one-off flaw becomes lasting control.
Fictional case: a code execution flaw in a file upload form lets an attacker make the web server open an outgoing connection. The firewall, set to let all outbound traffic through, allows it. One simple rule, “a web server does not contact the internet on its own”, would have blocked the attack.
How to protect yourself
- Filter outbound traffic: a server should only reach the destinations it needs (updates, known APIs).
- Route workstations’ outbound web traffic through a proxy that filters and logs.
- Deploy an EDR that alerts when a web application launches a command interpreter.
- Fix remote code execution flaws and harden internet-facing applications.
