Reverse Shell Generator

Security Client-side reverse shell pentest netcat bash python php powershell security

This tool runs entirely client-side, in your browser: your data is never sent anywhere.

💻 Client-side tool. Everything (including the payload list) runs and stays in your browser. Nothing you type here is sent anywhere.

⚠️ Legal notice

This tool is provided for authorized penetration testing, CTFs, and educational lab environments only. Only run these payloads against systems you own or have explicit written permission to test. Unauthorized access to computer systems is illegal in most jurisdictions.

Try it

Tool / language available on the target

Attacker IP

Port

Encoding Payload

Listener reminder

How it works

All payloads live in a bundled payloads.json, each tagged with the tool/language it needs (nc, bash, python3, php, powershell, etc.), its target OS, and the raw command template with {IP} / {PORT} placeholders.
Pick one tool from the dropdown — this is meant to mirror real recon: "I popped a shell and I only have php / awk / nc -e available, what do I run?"
If that tool has more than one payload variant (e.g. different nc flag styles, or a Windows vs. Linux Python line), use Previous / Next variant to cycle through them.
Fill in your attacker IP and port — the payload updates live.
Choose an encoding:

Plain — raw command, ready to paste.
Base64 — wraps the payload so it can be dropped into contexts that mangle special characters (for PowerShell, this automatically produces a proper powershell -EncodedCommand <UTF-16LE base64> line).
URL-encoded — useful for injecting into a URL/GET parameter.

The payload box is syntax-highlighted based on the tool's language (bash, Python, PHP, PowerShell, Perl, Ruby, Java, Go, Lua, awk).
Click Copy to clipboard, then start your listener as shown in the reminder (typically nc -lvnp <port>).

Notes

This is a static, offline list of well-known public reverse shell one-liners (the same ones commonly referenced in pentest cheat-sheets) — nothing is generated dynamically or fetched from the internet.
Always double check quoting/escaping requirements of the shell you're injecting into (e.g. a web form, a SQLi stacked query, a command injection point) — some contexts need extra escaping this tool cannot know about.