The Top Netcat Commands: The Swiss Army Knife for Hackers

March 19, 2022 · 2 min read

Netcat gets called the "Swiss Army knife" because it does one thing at its core, move data over TCP/UDP, but that one thing turns out to be useful in a ridiculous number of situations. Listener, client, port scanner, file transfer tool, reverse shell handler. All from a single binary that's already installed on most Unix systems.

Here are the commands you'll actually use.

Listen for Connections

Set up a listener on a port. This is the receiving end for reverse shells, file transfers, or just testing connectivity.

nc -lvnp 8080

The -l flag listens, -v gives verbose output, -n skips DNS resolution, and -p specifies the port.

Connect to a Remote Host

The client side. Connect to any TCP service and interact with it directly. Useful for banner grabbing or manually talking to HTTP, SMTP, or any text-based protocol.

nc example.com 80

Port Relay

Pipe the output of one connection into another. This creates a simple relay, forwarding traffic from one port to a remote host.

nc -lvnp 8080 | nc example.com 80

Handy for pivoting through a compromised host when you don't have access to proper tunneling tools.

Send a File

Transfer files between machines without setting up SCP, FTP, or a web server. On the receiving end, start a listener. On the sending end, pipe the file in.

# Receiver
nc -lvnp 1234 > received.txt

# Sender
nc 10.10.10.5 1234 < test.txt

No authentication, no encryption. Use this on trusted networks or when you need a quick transfer during a pentest.

Port Scanning

Netcat can do basic port scanning. It's not nmap, but it works when nmap isn't available on the target.

nc -zvn 10.10.10.5 1-1000

The -z flag does a scan without sending data. You'll see which ports accept connections.

That's netcat. Five use cases, one tool. It's not fancy, but when you're on a minimal system with nothing else installed, it gets the job done.

← Back to all posts