Why are reverse shell connections so popular in the event of a successful intrusion? Many "hacking" videos show this and it is often seen in practice.

Would not most servers restrict outgoing connections initiated by the server on an odd port? Would this not be a basic firewall rule?

Apparently not as this technique is used as it is more likely to bypass firewalls, what I don't understand is why.

2 Answers 2


According to my experience, many people concentrate on preventing attacks in the first place and not on mitigating the impact. Therefore outgoing firewalls rules are often not a priority. Especially since you have to define exceptions for update servers, if automatic updates are desired. The list of IP-adresses has to be kept uptodate.

In my experience it is way more common for attackers to try to upload phpshell/perlshell/etc. in file upload forms. The attacker hopes that the files are stored in a folder that is reachable via the webserver with script execution enabled. Or to inject php code and remote includes into request parameters. Furthermore SQL and XSS attacks are quite common, so is phishing. Of course my observations are biases by the areas I am active in: web application and online game security.

That being said, it is of course still a good idea to have outgoing firewall rules.


Your firewall will have some open outbound port, and the bad guys will find and use it. You can usually tunnel out over port 443 (HTTPS), or if not, you could hide in HTTP messages relayed through a proxy server. Heck, the PositivePRO VPN product does (or, at least, did) this.

Your server might have an outbound firewall rule, and the bad guy might be able to disable it or get around it, depending on how badly owned you are (and keeping in mind that you can make the case that there are no "degrees" of owned - you are or you aren't).

Why shells? Well, you can generally do anything from a command prompt that you can do from a GUI, and usually more. They're also faster and lighter-weight than, say, tunneling out a graphical app via RDP. They can be easier to hide on the box as well, and have a smaller memory and CPU footprint.

  • I know why you would want a shell, just not why you would want a reverse shell. It seems easier to block the server from initiating an outgoing connection then it does to start a process and have it accept one. Commented Sep 7, 2011 at 20:22
  • 3
    It's a lot harder to get a connection in to your server (through the firewall) than it is to get out. Commented Sep 7, 2011 at 20:39

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .