cybersec+ shells

Reverse Shell

A remote shell session initiated from the victim's computer back to the attacker's listening server. This technique helps bypass firewalls by making the connection appear as legitimate outbound traffic.

Listener

A program or command an attacker runs on their own server to wait for an incoming connection from a victim's payload, typically to catch a reverse shell. (e.g., nc -lvp 443).

Payload / Stager

The malicious code or script executed on a victim's machine that initiates the connection back to the attacker's listener to establish a remote shell.

Netcat (nc)

A versatile command-line networking utility used to read from and write to network connections. It is a common tool for creating listeners and executing reverse shell payloads.

Egress Filtering

A network security control that restricts or blocks outbound traffic leaving an internal network. It's a key defense against reverse shells by preventing connections to unauthorized external ports and IP addresses.

Application Allow-listing

A security policy that explicitly defines which programs are allowed to run on a system. Any application not on the list is blocked, preventing the execution of unauthorized tools like nc.exe.

PowerShell

An advanced, object-oriented command-line shell and scripting language for Windows. It is heavily used in system administration and security for automation and management.

cron

A time-based job scheduler in Unix-like operating systems. It is used to automate and schedule the execution of scripts or commands at specific intervals, which can be used to maintain persistence for a backdoor.

Metasploit Framework

A popular open-source penetration testing framework used to discover, exploit, and validate vulnerabilities. It includes numerous tools for generating reverse shell payloads.

Cobalt Strike

A commercial threat emulation software platform used by red teams for advanced adversary simulations. It is a powerful command-and-control (C2) framework known for its sophisticated reverse shell capabilities.

Stateful Firewall

A firewall that tracks the state of active network connections. Because it automatically allows return traffic for connections initiated from inside the network, it can be bypassed by a reverse shell.

EDR / NGAV

Endpoint Detection and Response / Next-Generation Antivirus. Advanced endpoint security solutions that use behavioral analysis, memory scanning, and script-blocking to identify and stop threats like fileless malware and reverse shells.