Ethical Hacking

15.5    Measures to Protect Against Reverse Shells

Protection against reverse shells requires a multi-layered security approach that includes both technical and organizational measures. Reverse shells usually work via outgoing connections, e.g., via TCP on port 4444 or HTTP on port 80/8080. By default, many firewalls allow all outgoing connections, which is why only explicitly allowed outgoing connections should be permitted according to the default deny principle. Connections to unauthorized IP addresses and ports should be blocked, and proxy servers should be used to control HTTP/S traffic.

Reverse shells often generate suspicious network traffic, such as the use of unusual ports. Therefore, you should use intrusion detection systems such ...