Reverse Shell

Definitions

Reverse Shell is a type of remote access connection where the target computer initiates an outbound connection back to the attacker's machine, providing the attacker with an interactive command-line interface to the target system. This technique is particularly effective for bypassing firewalls, which typically block incoming connections but allow outbound traffic. The attacker sets up a listener on their machine, and when the reverse shell payload executes on the target (via a vulnerability or social engineering), the target reaches out to the attacker's IP and port, establishing the shell session. Common implementations use tools like Netcat, Bash, Python, PowerShell, or Metasploit's Meterpreter. Reverse shells are a standard post-exploitation technique in penetration testing and a key indicator of compromise in incident response. Detection methods include monitoring for unusual outbound connections, anomalous process behavior, and network traffic patterns. Encrypted reverse shells using SSL/TLS make detection more difficult.
In plain English: Instead of the hacker connecting to your computer, your compromised computer connects out to the hacker — getting around firewalls that only block incoming traffic.

1990s: As firewalls begin blocking inbound connections, attackers develop the reverse shell technique — making the victim connect outward to the attacker
2000s: Netcat ('the TCP/IP Swiss Army knife') becomes the standard tool for establishing reverse shells, beloved by pentesters
2010s: Reverse shells become a core technique in the MITRE ATT&CK framework under Command and Control