Forem

Cover image for Sniffing the Reverse Shell
Kalaimani
Kalaimani

Posted on • Edited on

4 1

Sniffing the Reverse Shell

This is a follow up of my previous post Glimpse of Reverse Shell

Now we are going to see how the reverse shell's network traffic looks like using the Wireshark.

First start Wireshark (assuming that you have already installed it in your machine) and click the capture button after selecting your targeted network interface (in my case I have only one "Ethernet").

Image description

Then follow the steps from Glimpse of Reverse Shell and type any command in the reverse shell. It will generate some network and it will show up on the WireShark at midst of other network activities.

Image description

In our case we know the destination port is 8989, so we can apply it as filter like this,

Image description

Then we can follow the TCP stream of the filtered traffic

Image description

Finally we get see the result of the command that have executed remotely

Image description

Again it is very beginner level demonstration of how to look for network traffic of a naive reverse shell. In real world scenario it would be complicated to varying degrees. For example the network traffic might be encrypted or the data might be obfuscated. I hope this helps you to get some basic understanding of the reverse shell's traffic..

Image of Timescale

🚀 pgai Vectorizer: SQLAlchemy and LiteLLM Make Vector Search Simple

We built pgai Vectorizer to simplify embedding management for AI applications—without needing a separate database or complex infrastructure. Since launch, developers have created over 3,000 vectorizers on Timescale Cloud, with many more self-hosted.

Read full post →

Top comments (0)

Billboard image

The Next Generation Developer Platform

Coherence is the first Platform-as-a-Service you can control. Unlike "black-box" platforms that are opinionated about the infra you can deploy, Coherence is powered by CNC, the open-source IaC framework, which offers limitless customization.

Learn more

👋 Kindness is contagious

Immerse yourself in a wealth of knowledge with this piece, supported by the inclusive DEV Community—every developer, no matter where they are in their journey, is invited to contribute to our collective wisdom.

A simple “thank you” goes a long way—express your gratitude below in the comments!

Gathering insights enriches our journey on DEV and fortifies our community ties. Did you find this article valuable? Taking a moment to thank the author can have a significant impact.

Okay