How outgoing tunnels are not stopped by AV or firewalls?
How can an attacker with initial access to a server behind a firewall, which only has SSH, HTTPS, and HTTP ports open, maintain remote access to the server even after the SSH port is closed by the user on the firewall?
I have searched these questions and answers but none of them directly answering the question:
- How do persistent reverse shells and other malware gain their persistancy?
- Why would people connect to reverse shell’s server side?
- When to use a Bind shell vs. a Reverse shell?
I knew its by implementing any kind of reverse shell, creating a tunnel that sending outbound connection to attacker server:
Why a tunnel – reverse shell not detected by Firewall or such Antivirus on the OS? until this point, I worked on many computers and tested if a tunnel works or not, none of them blocked me even with enterprise firewall and client security software.
Continue reading How outgoing tunnels are not stopped by AV or firewalls?