network-netcat

name	network-netcat
description	Network utility for reading and writing data across TCP/UDP connections, port scanning, file transfers, and backdoor communication channels. Use when: (1) Testing network connectivity and port availability, (2) Creating reverse shells and bind shells for authorized penetration testing, (3) Transferring files between systems in restricted environments, (4) Banner grabbing and service enumeration, (5) Establishing covert communication channels, (6) Testing firewall rules and network segmentation.
version	0.1.0
maintainer	[e-mail]
category	offsec
tags	["networking","netcat","reverse-shell","file-transfer","port-scanning","banner-grabbing"]
frameworks	["MITRE-ATT&CK","PTES"]
dependencies	{"packages":["netcat","ncat"]}
references	["https://nmap.org/ncat/guide/index.html","https://attack.mitre.org/techniques/T1059/"]

Netcat Network Utility

Overview

Netcat (nc) is the "Swiss Army knife" of networking tools, providing simple Unix utility for reading and writing data across network connections. This skill covers authorized offensive security applications including reverse shells, bind shells, file transfers, port scanning, and banner grabbing.

IMPORTANT: Netcat capabilities can be used maliciously. Only use these techniques in authorized penetration testing environments with proper written permission.

Quick Start

Basic connection and listening:

# Listen on port 4444
nc -lvnp 4444

# Connect to remote host
nc <target-ip> <port>

# Banner grab a service
echo "" | nc <target-ip> 80

# Simple port scan
nc -zv <target-ip> 1-1000

Core Workflow

Netcat Operations Workflow

Progress: [ ] 1. Verify authorization for network testing [ ] 2. Test basic connectivity and port availability [ ] 3. Perform banner grabbing and service enumeration [ ] 4. Establish reverse or bind shells (if authorized) [ ] 5. Transfer files between systems [ ] 6. Create relay and pivot connections [ ] 7. Document findings and clean up connections [ ] 8. Remove any backdoors or persistence mechanisms

Work through each step systematically. Check off completed items.

1. Authorization Verification

CRITICAL: Before any netcat operations:

• Confirm written authorization for network testing
• Verify in-scope targets and allowed activities
• Understand restrictions on shell access and data exfiltration
• Document emergency contact procedures
• Confirm cleanup requirements post-engagement

2. Basic Connectivity Testing

Test network connectivity and port availability:

# TCP connection test
nc -vz <target-ip> <port>

# UDP connection test
nc -uvz <target-ip> <port>

# Test port range
nc -zv <target-ip> 20-30

# Verbose output
nc -v <target-ip> <port>

Connection test results:

• Connection succeeded: Port is open and accepting connections
• Connection refused: Port is closed
• Connection timeout: Port is filtered by firewall or no response