1

I understood the difference between them. The problem is I am not sure when to use each. I mean, if a firewall will block my connection to the target when I use bind shell, why the connection will not be blocked, when I send the payload again through reverse shell

1
  • I edited the title of your question to fit the question better. If you don't agree with that change, please feel free to roll it back to your initial title.
    – user163495
    Commented Feb 7, 2020 at 13:47

1 Answer 1

4

In order to understand why one might work when the other might not, you need to look at how firewall configurations work.

Consider an average employee computer. Most, if not all connections, will be outgoing first. Any incoming data would be in response to an outgoing connection. As such, a simple bind shell may be blocked by the firewall. I'll illustrate this below:

                                                   I want to connect to this host
                                                   on your local network.
                                                                     \
                                      That does not seem right.       \
                                      I will block this.               \
                                        /                               \
  +----------+               +----------+                               +----------+
 /          /|              /          /|                              /          /|
+----------+ |             +----------+ |                             +----------+ |
|          | |             |          | |                             |          | |
| Employee | | <-/-/-/-/-+ | Firewall | | <-------------------------+ | Attacker | |
| Computer | +             |          | +                             | Computer | +
|          |/              |          |/                              |          |/
+----------+               +----------+                               +----------+

However, a reverse shell looks to the firewall like the employee computer is initiating the connection to some remote host, and thus may accept it. You can imagine the situation like this:

            I want to connect to
          this host on the internet.
                /
               /                 Seems normal to me.
              /                     Go ahead!
             /                               \
  +----------+                               +----------+               +----------+
 /          /|                              /          /|              /          /|
+----------+ |                             +----------+ |             +----------+ |
|          | |                             |          | |             |          | |
| Employee | | +-------------------------> | Firewall | | +---------> | Attacker | |
| Computer | +                             |          | +             | Computer | +
|          |/                              |          |/              |          |/
+----------+                               +----------+               +----------+
6
  • So we can say that reverse shell is like the targeted computer asks for a connection to the attacker's computer, so when when the attacker respond, the firewall will allow the response? Commented Feb 8, 2020 at 17:11
  • @hosam.shafik Exactly. Likewise, a bind shell may succeed on a server, because the server expects to respond to incoming requests.
    – user163495
    Commented Feb 9, 2020 at 10:25
  • Your illustration is really cool. Can you please give me an example when to use to use bind shell and when to use reverse shell? Commented Feb 10, 2020 at 12:37
  • @hosam.shafik As I said in my answer, reverse shells work well when a firewall expects outgoing traffic, while bind shells work well when a firewall expects incoming traffic. Though of course, this is just a rule-of-thumb.
    – user163495
    Commented Feb 10, 2020 at 13:00
  • 1
    @Graa I use ASCIIFlow for this. And many many RFCs do have ASCII art
    – user163495
    Commented Feb 11, 2020 at 9:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .