1

I had made a multiclient TCP reverse shell and saw a course video which said HTTP reverse shells are better because how its difficult to trace back to the attacker compared to TCP . I didn't understand it .

I have tried googling this question with not much help .

Are HTTP reverse shells actually beneficial over TCP ? How ?

I personally think having HTTP reverse shell is bad since http is connectionless , when the attacker wants to communicate with the host , it can't since there is no connection to it and attacker can only communicate if a request (like GET) comes from the host. Am I missing anything here ?

Please explain....

Natesh bhat
  • 12,274
  • 10
  • 84
  • 125
  • 2
    This question doesn't make much sense on it's face. HTTP is an application-level protocol that uses TCP as a transportation-level protocol; any HTTP connection will necessarily also be a TCP connection. The video you're referring to might be saying that a raw TCP connection (e.g. `netcat` listening on a given port) is generally less useful than something like a maliciously constructed web page (e.g. installing something that executes commands passed as GET parameters), but that doesn't really make much sense either. – F. Stephen Q Jul 30 '18 at 15:43

1 Answers1

3

First, I am just going to answer for HTTPS over HTTP because I don't see much reason to use HTTP over HTTPS, but there are a lot of benefits to encrypting your traffic this way.

  1. It's unlikely to be auto-filtered

Many networks will block outbound traffic other than a few special ports. So, using something like port 6666 is likely to set off a few alerts. If you try to use a port for something other than it's intended use, some software can use deep packet inspection (DPI) to detect/block this. In other words, if your payload tries to use port 80/443 without using HTTP/HTTPS, it may raise an alert and get your payload caught.

  1. It's stealthier.

I would say two of the most important factors to being a stealthy payload are looking like normal traffic so as to avoid attracting attention in the first place and to be difficult to inspect if attention does come to your connection. HTTPS accomplishes both of these rather well.

This is because on most networks, it is extremely common to see nodes on your network making requests to the internet all the time. Compare a beaconing payload making HTTPS requests to some payload connecting over some random port.

Now, as far as your question at the end... it depends on your situation, but you are right that there will often be a delay if you use something like HTTP(S) over maintaining an established connection. I alluded to this earlier, but we are able to communicate through beaconing. Essentially, that just means that the payload will check back with the server on a set interval (often with a jitter to make it a little harder to detect).

The victim will make an HTTP(S) request to your command and control (C2) server that contains the results of the previous command you told it to run. Your server will return an HTTP(S) response that contains the next instructions for the payload.

Gray
  • 7,050
  • 2
  • 29
  • 52