Netcat Section 4 of 14

Port Scanning

While not as feature-rich as dedicated port scanners like Nmap, Netcat can perform basic port scanning to identify open ports and services on a target host.

Basic Port Scanning

Use the -z flag for zero-I/O mode (scan only, no data transfer) and -v for verbose output to see which ports are open.

Scan a Single Port

Check if a specific port is open:

nc -zv example.com 80

Output shows connection succeeded if port is open

Scan Multiple Ports

Check several specific ports:

nc -zv example.com 22 80 443 8080

Scan a Port Range

Scan a range of ports using hyphen notation:

nc -zv example.com 1-1000

UDP Port Scanning

UDP scanning is less reliable than TCP scanning because UDP is connectionless and doesn't guarantee responses. However, Netcat can still attempt UDP scans.

UDP Scan

Scan UDP ports (less reliable):

nc -zu example.com 53

No response might mean open, filtered, or no service

Service Banner Grabbing

After identifying an open port, you can connect to grab the service banner to identify what's running:

Grab HTTP Banner

Connect and manually send an HTTP request:

nc example.com 80 <!-- Then type: -->GET / HTTP/1.1Host: example.com

Grab SSH Banner

SSH services often send a banner immediately upon connection:

nc -v example.com 22

Look for the SSH version string in the output

Next: Banner Grabbing