1

I understood the difference between them. The problem is I am not sure when to use each. I mean, if a firewall will block my connection to the target when I use bind shell, why the connection will not be blocked, when I send the payload again through reverse shell

  • I edited the title of your question to fit the question better. If you don't agree with that change, please feel free to roll it back to your initial title. – MechMK1 Feb 7 at 13:47
4

In order to understand why one might work when the other might not, you need to look at how firewall configurations work.

Consider an average employee computer. Most, if not all connections, will be outgoing first. Any incoming data would be in response to an outgoing connection. As such, a simple bind shell may be blocked by the firewall. I'll illustrate this below:

                                                   I want to connect to this host
                                                   on your local network.
                                                                     \
                                      That does not seem right.       \
                                      I will block this.               \
                                        /                               \
  +----------+               +----------+                               +----------+
 /          /|              /          /|                              /          /|
+----------+ |             +----------+ |                             +----------+ |
|          | |             |          | |                             |          | |
| Employee | | <-/-/-/-/-+ | Firewall | | <-------------------------+ | Attacker | |
| Computer | +             |          | +                             | Computer | +
|          |/              |          |/                              |          |/
+----------+               +----------+                               +----------+

However, a reverse shell looks to the firewall like the employee computer is initiating the connection to some remote host, and thus may accept it. You can imagine the situation like this:

            I want to connect to
          this host on the internet.
                /
               /                 Seems normal to me.
              /                     Go ahead!
             /                               \
  +----------+                               +----------+               +----------+
 /          /|                              /          /|              /          /|
+----------+ |                             +----------+ |             +----------+ |
|          | |                             |          | |             |          | |
| Employee | | +-------------------------> | Firewall | | +---------> | Attacker | |
| Computer | +                             |          | +             | Computer | +
|          |/                              |          |/              |          |/
+----------+                               +----------+               +----------+
| improve this answer | |
  • So we can say that reverse shell is like the targeted computer asks for a connection to the attacker's computer, so when when the attacker respond, the firewall will allow the response? – hosam.shafik Feb 8 at 17:11
  • @hosam.shafik Exactly. Likewise, a bind shell may succeed on a server, because the server expects to respond to incoming requests. – MechMK1 Feb 9 at 10:25
  • Your illustration is really cool. Can you please give me an example when to use to use bind shell and when to use reverse shell? – hosam.shafik Feb 10 at 12:37
  • @hosam.shafik As I said in my answer, reverse shells work well when a firewall expects outgoing traffic, while bind shells work well when a firewall expects incoming traffic. Though of course, this is just a rule-of-thumb. – MechMK1 Feb 10 at 13:00
  • 1
    @Graa I use ASCIIFlow for this. And many many RFCs do have ASCII art – MechMK1 Feb 11 at 9:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.