// TOOLS

Security Tools

🐚 Reverse / Bind Shell Generator

30+ language payloads with shell selection, Base64/URL/double-URL encoding for WAF evasion, the recommended listener (nc, rlwrap, ncat, socat, pwncat, msfconsole) and a TTY-upgrade cheat sheet. Reverse, bind and msfvenom.

Generated command 

      
      
    


    


    

      Stabilise the shell (TTY upgrade)
      

        

          1
          

            python3 -c 'import pty;pty.spawn("/bin/bash")'
            
Spawn a PTY. Alternative: script -qc /bin/bash /dev/null

          

          
        

        

          2
          

            Ctrl + Z
            
Background the shell.

          

        

        

          3
          

            stty raw -echo; fg
            
Set the terminal to raw mode and return to the shell (press Enter twice).

          

          
        

        

          4
          

            export TERM=xterm-256color; export SHELL=/bin/bash
            
Enables clear, less, nano, colours...

          

          
        

        

          5
          

            stty rows 38 columns 116
            
Fix the size. Get your real values with stty -a in your local terminal.

          

          
        

      

    


    

      ⚠️ For lab environments, CTFs or systems with explicit written permission only. Unauthorised use is illegal.    

  







  
Frequently asked questions

  

    Is it legal to use this tool?
    
Generating the command is legal. Using it is only legal on your own systems, labs, CTFs or with explicit written permission; unauthorized use against third-party systems is a crime.

  

  

    What is the difference between a reverse shell and a bind shell?
    
In a reverse shell, the target connects back to you (useful behind NAT or when outbound is open). In a bind shell, the target listens on a port and you connect to it.

  

  

    What is the "TTY upgrade" for?
    
A basic reverse shell has no interactive terminal: no autocomplete, no history, and Ctrl+C kills it. The stabilization steps give you a full TTY.

  

  

    Why encode the payload in Base64?
    
To avoid quoting and special-character issues when pasting it, and to dodge filters or WAFs that look for the command in clear text.