I am new to penetration testing and I would like to know the differences between these two things:

  1. Payload (reverse TCP vs. bind shell)

  2. Shell vs. Shellcode

Any help?

Thanks in advance.

  • Could you clarify which terms you don't understand? Your title asks for the difference between a payload and the shell, but the question body contains additional terms. – Arminius Aug 16 '17 at 2:25
  • Yes the difference between Payload and shellcode, and the other sub-terms – user156894 Aug 16 '17 at 2:47

When exploiting an application, the payload is the code that the attacker actually wants to execute. It's the part that not just serves the purpose of leveraging the vulnerability itself, but does whatever the attacker considers useful.

When choosing a payload, an attacker typically wants code that starts them a shell. A shell is the program you interact with on the command line to control your OS (on Linux you might be familiar with the Bourne shell or Bash).

A payload that starts a shell is referred to as shellcode. But note that you will eventually find payloads that don't start a shell sloppily called shellcode, too.

A bind shell is a program that binds itself to a port and listens for incoming connections. Since opening a port attracts attention and because the attacker might often not be able to reach the port from outside the network, there is an opposite concept: A reverse shell doesn't wait for incoming connections but connects to a specified address and port itself. That is, the attacker waits for an incoming connection by the compromised server instead of initiating the connection themself.


Shellcode is injected with the payload or even sometimes referred to as payload in general. Payload on the other hand doesnt necessarily have to be shellcode (code spawning a shell) but could be code performing any action of your choice, i.e. spawning a calculator, reboot the system,... The payload usually not only includes the code to be injected and executed but also encompasses return addresses, NOP sleds, new SEH's, stub data fixing the stack, decoder, egghunter,...

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.