What is a Reverse, Bind and Forward Shell

A reverse shell, a forward shell, and a bind shell are three types of connections used during penetration testing or exploitation to gain remote access to a system. Although all of them allow interaction with a victim machine through a command line, they mainly differ in the direction of the connection and in who initiates the communication.

Reverse shell
In a reverse shell, the victim machine initiates the connection toward the attacker. In other words, the attacker sets their machine to listen, and when the victim executes the payload, it connects back to the attacker. This is very useful when the victim is behind a firewall or NAT that blocks incoming connections but allows outgoing ones. For example, the attacker listens with netcat on their system, and the victim runs a command that performs a “connect back” to the attacker’s port. Once established, the attacker gains interactive shell access on the victim system.

Bind shell
In a bind shell, the process is the opposite. The victim opens a port and “binds” a shell to that port, waiting for the attacker to connect. The attacker simply makes a direct connection to the exposed port and gains access. It’s simpler in theory but often limited by firewalls that block inbound connections to the victim. For this reason, although it’s easy to implement, its practical use is less common in protected real-world environments.

Forward shell
The term forward shell is less common, but it describes an intermediate or “routing” case of connections. It can refer to a session that redirects traffic from a compromised machine to another one, acting as a tunnel or proxy to pivot inside an internal network.. In other words, a forward shell doesn’t necessarily create a direct attacker–victim session, but can instead be used to move deeper into an infrastructure after the initial access.

Concept summary
Reverse shell: the victim connects to the attacker.
Bind shell: the attacker connects to the victim.
Forward shell: the traffic or session is forwarded through another machine or network.