What is a reverse shell? Definition, examples & defenses

A reverse shell flips the normal direction of a connection. Instead of the attacker connecting in to the victim (a bind shell), the victim connects out to the attacker. This is powerful because outbound connections often pass through firewalls and NAT that would block inbound ones.

How does a reverse shell work?

1. The attacker starts a listener on a machine they control, often with netcat or the Metasploit handler.
2. The attacker gets the target to run a small payload, frequently via an exploited vulnerability.
3. The payload opens an outbound connection from the target back to the listener.
4. The attacker now has an interactive shell on the target.

Payloads can be written in many languages, including Bash, Python, PowerShell, and PHP, and msfvenom is commonly used to generate them.

Bind shell vs reverse shell

• A bind shell opens a port on the target and waits for the attacker to connect in.
• A reverse shell has the target connect out, which is more firewall-friendly and far more common in real attacks.

Why it matters

Getting a reverse shell is often the moment of initial access in an attack, after which an operator pursues privilege escalation and lateral movement. Defenders detect reverse shells through egress filtering and network security monitoring.

How to practice reverse shells hands-on

On Purple Edge the penetration-testing learning hub lets you exploit real targets and catch live reverse shells in isolated cloud labs, then upgrade them to fully interactive sessions.