Netcat Section 4 of 14

Banner Grabbing

Banner grabbing is a technique to extract service information (software name, version, and sometimes configuration details) from network services. Netcat can connect to a port and display the banner that the server sends upon connection—often revealing version numbers and other reconnaissance data.

How Banner Grabbing Works

Many services (SSH, FTP, SMTP, HTTP, etc.) send an introductory message when a client connects. This banner often includes the software name and version number. Netcat simply opens a TCP connection and prints whatever the server sends back. This passive information gathering is often the first step in identifying potential vulnerabilities.

Classic Banner Examples

bash

1nc -nv 10.0.0.1 22

SSH banner — reveals OpenSSH version

bash

1nc -nv 10.0.0.1 21

FTP banner — reveals vsftpd or ProFTPD version

bash

1nc -nv 10.0.0.1 25

SMTP banner — reveals Postfix, Exim, or Sendmail version

bash

1nc -nv 10.0.0.1 80

HTTP banner — Server header or initial response

Common Banner Grab Examples

Grab SSH Banner

bash

1nc -nv 10.0.0.1 22

Connects to port 22 (SSH) and prints the version banner. Useful for identifying OpenSSH versions and potential CVEs.

Grab HTTP Server Banner

bash

1echo -e "HEAD / HTTP/1.1\r\nHost: 10.0.0.1\r\n\r\n" | nc 10.0.0.1 80

Some HTTP servers do not send a banner upon connection. Sending a minimal HTTP HEAD request forces a response that includes the Server header.

Grab SMTP Banner

bash

1nc -nv 10.0.0.1 25

Connects to port 25 (SMTP). The server typically responds with its mail server software and version. Follow up with EHLO test to gather further capabilities.

Grab POP3/IMAP Banner

bash

1nc -nv 10.0.0.1 110

Port 110 (POP3) or 143 (IMAP) often reveal the mail server software. This helps determine if the server is running Dovecot, Courier, or another service with known vulnerabilities.

Multiple Ports with a Loop

bash

1for port in {21,22,23,25,80,443,3306}; do
2  echo -e "\n-- Port $port --" | nc -nv -w 2 10.0.0.1 $port
3done

Iterates over a set of common ports to quickly gather banners from multiple services. Adjust the port list based on your target's open ports (from a prior scan).

Interpreting Banners

After capturing a banner, extract the software name and version number, then search for known exploits. Examples:

Banner Example	Interpretation	Action
SSH-2.0-OpenSSH_8.2p1	OpenSSH 8.2p1 on Ubuntu	Search: CVE OpenSSH 8.2p1
220 mail.example.com ESMTP Postfix	Postfix SMTP server	Search: Postfix exploits 2024
220 vsFTPd 3.0.3	vsftpd 3.0.3 (very old, likely vulnerable)	Search: vsFTPd 3.0.3 exploit

Warning

Banners can be intentionally modified (obfuscated) by administrators to mislead attackers. Some services hide or change their version string. Always verify findings with additional enumeration techniques.

Next: Chat Application Back