Reverse Shell Cheat Sheet: The Practical Hacking Cheatsheet Series

Reverse shells are one of the first things every penetration tester, red teamer, or CTF player learns. Whether you’re solving Hack The Box machines, tackling ProLabs, participating in CTFs, or performing internal penetration tests, knowing how to quickly establish a shell can save valuable time during an engagement.

Getting remote code execution is only half the battle. The next challenge is turning that execution into a reliable interactive shell.

Depending on the target environment, you may need to answer questions like:

• Which reverse shell works on this system?
• Is Bash available?
• Does Python exist?
• Can I use PowerShell on Windows?
• Should I use PHP, Perl, Ruby, or Node.js?
• What listener should I start?
• How do I upgrade to a fully interactive TTY?
• Can I generate a payload with MSFVenom?
• Do I need to Base64 or URL encode the payload?
• Which web shell is appropriate for this application?

That’s why Part 5 of my Practical Hacking Cheatsheet Series focuses on:

Reverse Shell Cheat Sheet

This cheatsheet is designed as a clean, practical reference for the most commonly used reverse shell payloads and listeners encountered during HTB machines, CTFs, ProLabs, and real-world penetration tests. Instead of searching dozens of cheat sheets, you’ll find the most useful one-liners and post-exploitation techniques in one place.

The full Reverse Shell Cheat Sheet covers topics like:

• Netcat, Socat, and Pwncat-CS listeners
• Bash reverse shells
• Python reverse shells
• PHP reverse shells
• PowerShell reverse shells
• Perl reverse shells
• Ruby reverse shells
• Node.js reverse shells
• Java reverse shells
• Lua reverse shells
• Groovy (Jenkins) reverse shells
• Upgrading to a fully interactive TTY
• PTY spawning
• Terminal fixes using stty
• Web shell examples (PHP, JSP, ASPX)
• Base64 encoded payloads
• URL encoded payloads
• PowerShell Base64 payloads
• MSFVenom payload generation
• Linux ELF payloads
• Windows EXE payloads
• PHP, ASPX, WAR, and Python payloads

This part is especially useful when you’ve already achieved command execution and need a quick, reliable way to establish or improve shell access.

For example:

• Which reverse shell should I try first?
• What listener should I start?
• How do I get an interactive shell?
• How do I upgrade a dumb shell into a proper TTY?
• Which language payload should I use if Bash isn’t available?
• How do I generate a reverse shell using MSFVenom?
• How do I create a PHP or JSP web shell?
• When should I encode a reverse shell payload?
• How do I execute a Base64-encoded Bash shell?
• Which reverse shell works on Windows?

The main idea is simple: don’t waste time searching the internet during an engagement. Having the right reverse shell ready can mean the difference between losing access and successfully continuing your assessment. This cheatsheet brings together the most practical payloads, listeners, web shells, and shell upgrade techniques into a single reference you can rely on.

Full Cheatsheet Series

This is the complete Practical Hacking Cheatsheet Series:

Part	Cheatsheet	Focus
Part 1	Active Directory	AD attack methodology and commands
Part 2	Web Application	Web exploitation techniques and payloads
Part 3	Linux Privilege Escalation	Linux privilege escalation vectors
Part 4	Windows Privilege Escalation	Windows privilege escalation vectors
Part 5	Reverse Shells	Reverse shell one-liners and shell upgrades
Part 6	File Transfers	Methods to transfer files between machines
Part 7	Pivoting	SSH tunneling, Chisel, Ligolo, SOCKS
Part 8	Password Attacks	Cracking, spraying, brute-forcing
Part 9	Linux Enumeration	Post-exploitation Linux enumeration
Part 10	Windows Enumeration	Post-exploitation Windows enumeration

Each part is designed to be practical, concise, and easy to reference while solving machines, conducting penetration tests, or preparing for certifications like OSCP, CPTS, PNPT, and CRTO.

Who This Is For

This cheatsheet series is made for:

• Hack The Box players
• CTF enthusiasts
• ProLab students
• Beginner and intermediate penetration testers
• Red team operators
• OSCP, CPTS, PNPT, and CRTO students
• Linux and Windows security learners
• Cybersecurity students
• Anyone building a practical offensive security knowledge base

If you’re regularly exploiting machines, this Reverse Shell Cheat Sheet gives you a fast reference for establishing shell access, upgrading unstable shells, and selecting the right payload without wasting time hunting through multiple resources.