LHOST

LHOST stands for local host. It is a term used in cybersecurity tooling to designate the IP address or hostname to which a reverse-connection payload should connect. In reverse payloads, such as reverse shells or remote shells, the compromised system makes an outbound connection to the attacker’s machine, and the LHOST value identifies where that connection should be made. LPORT is the complementary setting that specifies the port.

In practice, LHOST is configured within the exploitation framework or payload generator on the attacker’s side. It is not the target’s local IP; rather, it is the address of the attacker’s host as reachable by the target. When a host is multi-homed, the operator must choose the appropriate network interface’s IP, or a DNS name that resolves to the reachable address. If the operator is behind NAT or a firewall, LHOST should be an address reachable from the target, which may require VPN, port forwarding, or a public IP.

Testing contexts use loopback addresses like 127.0.0.1 when the target and listener are on the same machine; however, for remote targets, a real network address is needed. The concept is present across many frameworks, but exact configuration syntax varies. Ethical note: configuring LHOST is intended only for authorized security testing and red team engagements.