Hands-On Red Team Tactics

Introduction to reverse connections

When the user connects to a server, the user binds its socket with the server's port. This is called a bind connection. Bind connections are only possible if incoming connections are allowed by the firewall. In a situation in which incoming connections are restricted, a user can ask the server to connect back. Firewalls generally restrict incoming connections but don't restrict outgoing connections. When the server makes an outgoing connection to the user, this is called a reverse connection.