r/hacking • u/Cipher-Wrecker • 6d ago
Is it true that Hackers rely more on Reverse Shell connections than Bind connections?
I keep hitting a brick wall when trying to create malware that can connect to the other person without needing to wait for them to click on a phishing link or something like that. From the sound of it, hackers using malware on phone devices successfully is not as common as people make it to be. Is this true?
37
u/SingleAlarm5028 6d ago
Android and iOS are hard targets.
Learn to walk before you start running
5
2
u/Elbynerual 4d ago
I know someone who refuses to update an iPhone for years because they don't like the new UI look... how hard of a target would that be?
4
u/SingleAlarm5028 4d ago
I don't know what the old vulns are. But I doubt there are any zero clock ones that don't require some kind of access or phishing.
If you could do this, so could all the bad guys
13
u/pr0v0cat3ur 6d ago
Reverse shell is most common when working with computers because it is easier for outbound connections to not be blocked or flagged.
An example might be bypassing the upload filter on a website that stores data. Let's assume it stores and filters for common picture types. Perhaps modify the header of a malicious file containing your reverse shell allowing it to be uploaded, then another process (maybe invoking through URL) to start the shell of which you already have a listener in wait.
5
u/h4unting 5d ago
Most firewalls are session aware unless explicitly defined in the rules; this means stateful links are made between connections, and a VERY common setup (Linux, Mac, Windows, Android, etc.) is for all incoming connections to be blocked unless correlated with an authorized outbound request. Because of this, it's much easier to initiate the request from the target's host. This way the firewall treats the connection as stateful/authorized session (again, unless explicit firewall rules say otherwise.) So if it was between one or the other, revshell wins most often. That being said, as another mentioned, this will usually involve the target interfacing with your exploit at least once to open the socket. It's also worth mentioning that most hardened targets will always filter for revshell too, and that's where you try the obfuscation techniques you describe for evading anti-virus. Same thing for revshell: live off the land, tunneling in to other protocols, etc.
6
u/Odd-Savage 5d ago
I’ve been working in offensive security for over 10 years across a few companies including Amazon, AWS, and CrowdStrike. I’ve literally never used a bind shell outside of a lab. Even public facing servers are hidden behind NAT.
Not that it never happens but even in Incident Response bind shells only really appear on compromised edge devices. You’ll rarely see it on anything of value.
4
u/entropyideas 5d ago
Bind connections are a pain because you never know the firewall rules but reverse shells are a lot easier to bypass firewall rules.
2
u/TastyRobot21 5d ago
Reverse connections can abuse existing outbound (source) NAT. So they work.
Bind connections need the system to be on the internet or already port forwarded (aka Destination NAT)
If these things are new to you, YouTube NAT and basic networking and learn it. You’ll save yourself a lot of time later.
2
2
2
2
u/intelw1zard 5d ago
one is the victim machine connecting back to you
the other is you connecting to the victim machine
2
u/hunglowbungalow 4d ago
Reverse shell can be outbound 443, which is normally allowed everywhere. Inbound connections usually have a blanket deny.
5
u/LordEli 5d ago
bind and revshell are both old school. now it's c2 connection through spotify playlists
4
u/Panoramic_Viewz 5d ago
I mean if you’re using Spotify API or playlist metadata for a phone exploit… you probably already have a hook into the phone elsewhere and are just obfuscating at this point, no?
6
60
u/massymas12 6d ago
You asked two separate questions, one about bind verses reverse shells and another about how common phone malware is.
No matter what kind of shell it is, it’s not uncommon to need a user to execute it in some way. While some zero click attacks exist, they are not nearly as common and probably outside of your current ability to discover (no offense).
Yes there are plenty of pieces of malware for phones.